Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
Detects the creation of '.diagcab' files, which can be used by legitimate installers but also by adversaries for exploitation or data collection. The rule suggests reviewing the filename and its location for further investigation.
This rule detects the creation of executable files (.exe) within the `C:\Windows\WinSxS\` directory by processes that are not located in standard system directories (`C:\Windows\Systems32\`, `C:\Windows\SysWOW64\`, or `C:\Windows\WinSxS\`). This behavior can be indicative of malware attempting to establish persistence or execute from a less commonly monitored system directory, potentially mimicking legitimate system components.
Detects the creation of a file named 'livekd.dmp' in the 'C:\Windows\' directory, which is the default output file for LiveKD kernel memory dumps. This activity can indicate an attempt to perform live kernel debugging, potentially for privilege escalation or defense evasion purposes.
Detects the creation of Process Explorer drivers by processes other than Process Explorer itself. This activity can indicate that hack tools or malware are attempting to use the Process Explorer driver for privilege escalation, often by dropping the driver to disk, running a service with it, and then removing it.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Detects the creation of the LiveKD driver file (LiveKdD.SYS) by the LiveKD or LiveK64 executables. LiveKD is a tool used for live kernel debugging, which can be leveraged by adversaries for defense evasion or privilege escalation by interacting directly with the kernel.
Detects a potential privilege escalation attempt by monitoring the creation of specific ".Exe.Local" folders within the "System32" directory. This technique is used to sideload "comctl32.dll" into legitimate Windows processes, which can lead to privilege escalation or persistence.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects new BITS transfer job saving local files with potential suspicious extensions
Yara rule that detects Lorenz ransomware.
Page 216 of 216