Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.
Detects the execution of 'DumpMinitool.exe', a tool used to dump process memory, specifically targeting the 'MiniDumpWriteDump' function. This tool can be used to extract credentials from processes like LSASS.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects a CodePage modification using the "mode.com" utility. This behavior has been used by threat actors behind Dharma ransomware.
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading. This technique can be used for defense evasion by masquerading malicious code as legitimate system components.
Detects the modification of the system's code page to Russian language (code page 1251 or 866) using the `mode.com` utility. This activity has been observed in attacks involving Dharma ransomware and other malware.
This rule detects the execution of NetSupport RAT, specifically looking for instances where the 'client32.exe' component has been renamed. It identifies the RAT by checking for specific product strings ('NetSupport Remote Control'), original file names ('client32.exe'), or a known Imphash (A9D50692E95B79723F3E76FCF70D023E). The rule explicitly excludes legitimate executions of 'client32.exe' to focus on renamed instances, indicating an attempt at defense evasion.
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. This technique can be used for defense evasion by masquerading the execution of arbitrary commands.
Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
Detects the execution of 'find.exe' or 'findstr.exe' where the command line arguments include a '.lnk' file. This behavior has been observed in attacks, such as the HHS redirect attack, where adversaries use these legitimate Windows utilities to indirectly execute malicious shortcut files.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
Detects suspicious execution of AgentExecutor.exe, a Microsoft Intune component, when it is used to launch PowerShell scripts with potentially bypassed execution policies or to execute a 'powershell.exe' binary from a specified path. This behavior can be indicative of a Living Off The Land Binary (LOLBIN) abuse.
Detects the execution of 'CustomShellHost.exe' where its child process is not 'C:\Windows\explorer.exe'. This behavior can indicate an attempt to use CustomShellHost for proxy execution, potentially bypassing security controls or for defense evasion.
Detects the execution of a renamed Plink binary, which is often used by adversaries for SSH tunneling and data exfiltration. The rule specifically looks for the original filename 'Plink' combined with command-line arguments indicative of port forwarding ('-l forward', '-P', '-R'), while filtering out legitimate executions of 'plink.exe' to reduce false positives.
This rule detects the creation of processes from unusual and potentially suspicious locations on a Windows system. Specifically, it looks for executables being run from the 'RECYCLER' directory, 'SystemVolumeInformation' directory, or various subdirectories within 'C:\Windows\' that are not typically used for executable storage, such as 'Tasks', 'debug', 'fonts', 'help', 'drivers', 'addins', and 'cursors'. Adversaries often use these locations to hide malicious executables and evade detection.
Page 39 of 40