Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the loading of kernel modules using the 'insmod' command. Loadable Kernel Modules (LKMs) are code segments that can be dynamically loaded into and unloaded from the kernel. Adversaries may leverage LKMs for establishing persistence, elevating privileges, or deploying kernel-mode rootkits, as they operate with the highest system privileges (Ring 0). The detection specifically looks for the execution of 'kmod' with the 'insmod' command.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects the installation of a new Windows service where the service executable's image path contains suspicious locations such as 'AppData' directories or remote IP addresses like '127.0.0.1' or 'localhost'. This can indicate an attempt at persistence or privilege escalation by adversaries installing malicious services in non-standard locations.
Detects the creation of new PowerShell module files (.ps or .dll) in the first folder of the module directory structure, specifically within '\WindowsPowerShell\Modules\*\'. This pattern is considered suspicious because legitimate PowerShell modules commonly include a version folder within their directory structure, making direct creation in the module root less common for benign modules.
This rule detects the creation of executable files (.exe) or dynamic link libraries (.dll) within the default Group Policy Object (GPO) storage folder. Adversaries may place malicious files in this location to leverage Group Policy for persistence, privilege escalation, or to distribute malware across a domain. The specific folder path targeted is '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\' which corresponds to the Default Domain Policy GPO.
This rule detects the creation or modification of a PowerShell profile specifically for Visual Studio Code (VSCode). Adversaries may modify these profiles to establish persistence or escalate privileges by injecting malicious commands or scripts that execute every time a user opens a VSCode PowerShell session. This technique can be used to run arbitrary code without direct user interaction after the initial compromise.
This rule detects a specific pattern indicative of a User Account Control (UAC) bypass technique using 'IEInstal.exe'. Specifically, it looks for 'IEInstal.exe' creating a file named 'consent.exe' within a user's temporary application data directory (e.g., 'C:\Users\<username>\AppData\Local\Temp\'). This behavior is characteristic of UACMe, an open-source tool designed to exploit various UAC bypass methods.
Detects a specific User Account Control (UAC) bypass technique that involves modifying the msconfig GUI. This rule specifically looks for the creation of a file named 'pkgmgr.exe' within a user's temporary directory, which is a known indicator for the UACMe bypass method 55.
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.
Detects specific command-line patterns associated with Empire PowerShell UAC bypass methods. These patterns involve PowerShell commands designed to retrieve and execute content from the 'Update' registry key within 'HKCU:Software\Microsoft\Windows Update', which is a known technique used by Empire for privilege escalation.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects the highly unusual activity of 'svchost.exe' being spawned without any command-line arguments. This behavior is often indicative of a malicious process injecting code into the 'svchost.exe' memory space, leveraging a legitimate system process to evade detection. The rule specifically filters out known legitimate instances where 'svchost.exe' might appear without arguments, such as when spawned by 'rpcnet.exe' or 'rpcnetp.exe'.
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.
Detects an exploitation attempt of the SystemNightmare vulnerability, which aims to obtain a shell with LOCAL_SYSTEM privileges. The rule specifically looks for command-line arguments associated with known exploitation tools or techniques related to SystemNightmare, such as references to 'printnightmare.gentilkiwi.com', '/user:gentilguest', or 'Kiwi Legit Printer'.
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism.
Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This activity is associated with the SNAKE malware, as reported by CISA, which uses this technique for persistence.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
Detects the usage of the 'crontab' utility with the '-r' flag to remove the current user's crontab. This activity can be indicative of an adversary attempting to remove scheduled tasks for defense evasion or to eliminate competition, such as in the case of cryptocurrency miners.
Page 390 of 400