Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,397 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,691
1,318
905
813
745
Platforms
5,923
913
884
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Detects a specific pattern indicative of a User Account Control (UAC) bypass technique using DismHost DLL hijacking. This method, often associated with UACMe (specifically UACMe 63), involves a process named 'DismHost.exe' being launched from a user's temporary directory with elevated integrity levels (High or System). This behavior is suspicious because DismHost.exe is a legitimate Windows component, but its execution from a temporary user-specific path with elevated privileges suggests an attempt to bypass UAC.
Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.
This rule detects the execution of 'sdclt.exe' with elevated privileges (High integrity level). This behavior is often indicative of an attempt to bypass User Account Control (UAC) mechanisms on Windows systems. Attackers may leverage sdclt.exe, a legitimate Windows utility, to execute arbitrary commands or processes with administrative rights without triggering a UAC prompt.
Detects a specific User Account Control (UAC) bypass technique known as "IDiagnosticProfileUAC". This technique involves a process with high or system integrity level launching 'DllHost.exe' with a specific command-line argument containing '{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'. This behavior is indicative of an attempt to elevate privileges by bypassing UAC.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
Detects the execution of SharpMove, a .NET utility used for lateral movement that performs tasks such as task creation, Service Control Manager (SCM) queries, and VBScript execution via WMI. The detection is based on the executable name or original filename and the presence of specific command-line arguments indicating its functionality.
Detects modifications to the "Default" value of specific 'MyComputer' registry keys and their subkeys. This technique can be used by adversaries to establish persistence by pointing to a custom binary that will be launched when an associated action (e.g., opening 'My Computer') is executed. This method leverages less common registry locations for persistence compared to standard Run keys.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Detects the execution of the LocalPotato Proof-of-Concept (POC) tool. This detection is based on specific characteristics of the executable's image name, command-line arguments, and known import hashes (IMPHASH) associated with LocalPotato. The tool is known for exploiting vulnerabilities to achieve privilege escalation.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Page 383 of 400