Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
This rule detects the installation of the 'Remote Utilities - Host' service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation. The detection is further refined by checking for the presence of 'rutserv.exe' and '-service' in the ImagePath, or the exact service name 'Remote Utilities - Host'. This activity is often associated with remote access tools, which can be used legitimately for IT administration but also by adversaries for persistence and remote control.
This rule detects the creation of new Windows services with suspicious or uncommon image paths. It specifically looks for paths containing references to named pipes, common temporary directories like `Users\Public\` or `Windows\Temp\`, or image paths that include patterns indicative of encoded PowerShell commands (e.g., `-e` followed by specific base64 encoded strings). This behavior is often associated with adversaries establishing persistence or escalating privileges by creating malicious services.
Detects the installation of a new Windows service where the executable path contains suspicious patterns, specifically executables located directly under 'ProgramData' or the root of the C: drive with a short, potentially obfuscated name (e.g., 'C:\ProgramData\.{1,9}\.exe' or 'C:\.{1,9}\.exe'). This pattern is often used by malware for persistence and to evade detection by hiding in less common locations.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. This rule specifically looks for file events where the 'System' process is writing to 'iertutil.dll' within the 'Internet Explorer' directory, which could indicate an attempt to replace or modify a legitimate DLL for malicious purposes, potentially leveraging DCOM for remote execution.
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicate WMI ActiveScriptEventConsumers activity. This is a common technique for persistence and privilege escalation.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen. This rule specifically looks for processes like cmd.exe or powershell.exe being launched by winlogon.exe, with command-line arguments indicating an attempt to leverage Windows accessibility features such as sethc.exe (Sticky Keys), utilman.exe (Utility Manager), osk.exe (On-Screen Keyboard), Magnify.exe, Narrator.exe, or DisplaySwitch.exe.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
Detects when an attacker registers a new SIP provider for persistence and defense evasion by monitoring modifications to the 'mpnotify' registry key under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\'. This registry key is associated with Winlogon helper DLLs, which can be abused to execute malicious code during user logon.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
This rule detects the creation of the Process Monitor (procmon) driver file (.sys) by any process other than the legitimate Process Monitor executable itself (procmon.exe or procmon64.exe). This behavior can indicate an attempt to load a malicious or unauthorized driver, potentially for privilege escalation or persistence, by masquerading as a legitimate system utility.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Page 391 of 400