Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects a remote DLL load event via "rundll32.exe".
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Detects any assembly DLL being loaded by an Office Product
Detects CLR DLL being loaded by an Office Product
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Page 86 of 86