Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
58
48
18
3
Contributors
46
18
17
16
11
Categories
58
53
27
16
14
Platforms
91
36
8
3
3
Products / Services
69
66
20
17
12
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
CVEs
1
1
1
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
Page 7 of 7