Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,439
11,829
5,873
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file
Detects default lsass dump filename generated by SafetyKatz.
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
Detects javaw.exe in AppData folder as used by Adwind / JRAT
NTDS.DIT Created
Sigma
Detects creation of a file named "ntds.dit" (Active Directory Database)
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Detects the creation of a office macro file from a a suspicious process
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.
Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.
Detects Rclone config files being created
Detects default RemCom service filename which indicates RemCom service installation and execution
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects default PsExec service filename which indicates PsExec service installation and execution
Page 138 of 139