Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects new BITS transfer job saving local files with potential suspicious extensions
Yara rule that detects Lorenz ransomware.
Page 217 of 217