Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,395 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,691
1,318
905
813
745
Platforms
5,923
913
884
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects the installation of the NetSupport Manager client service on a Windows system. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service paths containing '\NetSupport Manager\client32.exe' or a service name of 'Client32'. This activity can be indicative of legitimate remote administration tool deployment or malicious use for persistence.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
This rule detects potential remote thread injection activities associated with the Bumblebee malware. Specifically, it looks for instances where 'wabmig.exe', 'wab.exe', or 'ImagingDevices.exe' create a remote thread in 'rundll32.exe'. This behavior is indicative of how Bumblebee operates to execute its malicious payload.
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
This rule identifies user sign-ins originating from anonymous IP addresses, which may indicate the use of VPNs, Tor, or other anonymization services. Such activity can be a sign of an adversary attempting to mask their true location or identity during an access attempt.
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
Detects exploitation attempts related to the Nimbuspwn privilege escalation vulnerabilities (CVE-2022-29799 and CVE-2022-29800) on Linux systems. The rule looks for specific keywords that indicate the `networkd-dispatcher` service is being manipulated, potentially to execute arbitrary code with elevated privileges.
Detects when important scheduled tasks are deleted or disabled. Adversaries may delete or disable scheduled tasks to hinder defensive capabilities, stop legitimate services, or prevent forensic analysis. This rule specifically targets tasks related to system restore, Windows Defender, BitLocker, Windows Backup, and Windows Update, which are critical for system integrity and security.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Detects the creation of a specific DLL file ('api-ms-win-core-kernel32-legacy-l1.DLL') within a user's temporary directory. This pattern is indicative of a User Account Control (UAC) bypass technique that leverages NTFS reparse points and DLL hijacking, often associated with tools like UACMe (specifically UACMe 36). The rule looks for the exact file path in a user's AppData\Local\Temp directory.
This rule detects a specific User Account Control (UAC) bypass technique leveraging the Windows Media Player component. Specifically, it looks for the creation of a file named 'OskSupport.dll' within a user's temporary directory, combined with 'DllHost.exe' accessing 'osk.exe' located in the Windows Media Player directory. This pattern is indicative of the UACMe tool's method 32, which exploits a vulnerability related to Windows Media Player to elevate privileges without user interaction.
Detects the execution of non-standard or uncommon assistive technology applications via "AtBroker.exe". AtBroker.exe is a legitimate Windows binary that can be abused to proxy the execution of other programs, often for defense evasion or persistence. This rule specifically looks for instances where AtBroker.exe is used to start applications that are not part of the common, built-in Windows assistive technologies.
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a User Account Control (UAC) bypass attempt. The rule specifically filters out legitimate child processes like 'mmc.exe' and 'WerFault.exe' to reduce false positives.
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.
Page 389 of 400