Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.
Detects the installation of a potentially suspicious new shim database using sdbinst.exe where the command line does not contain common, legitimate file extensions or flags. Adversaries may use application shimming for persistence or privilege escalation.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.
Detects modifications to the 'User Shell Folders' registry key, specifically targeting the 'Startup' value. This key can be manipulated by adversaries to achieve persistence by launching malicious payloads during system startup.
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
This rule detects the execution of PowerShell scripts containing specific Base64 encoded shellcode signatures. The rule looks for the presence of 'OiCAAAAYInlM' or 'OiJAAAAYInlM' within the ScriptBlockText, which are known indicators of shellcode.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Detects the use of the "Set-Service" PowerShell cmdlet to modify a service's Security Descriptor Definition Language (SDDL) to hide the service from standard enumeration utilities like "sc.exe" or "Get-Service". This technique leverages specific SDDL flags (DCLCWPDTSD) to restrict access and visibility, primarily effective in PowerShell 7 environments.
This rule detects the use of the 'sc.exe' utility to modify service DACLs (Discretionary Access Control Lists) by adding specific permissions ('DCLCWPDTSD'). This technique is often used by threat actors to hide services, making them unremovable and persistent, thereby achieving defense evasion, persistence, and privilege escalation.
This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
This rule detects the deletion of the 'SD' (Security Descriptor) value within the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\` registry hive. This action is typically performed by adversaries to hide scheduled tasks, making them less visible to standard enumeration tools. This technique has been observed in use by the Tarrask malware.
Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
Detects PowerShell script blocks that manipulate security descriptors using specific WMI classes and properties (win32_Trustee, win32_Ace, .AccessMask, .AceType, .SetSecurityDescriptor) in conjunction with specific LSA registry paths (Lsa\JD, Lsa\Skew1, Lsa\Data, Lsa\GBG). This combination is indicative of potential persistence mechanisms, as seen in projects like DAMP, which aim to backdoor systems by modifying security settings to maintain access or elevate privileges.
Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.
Page 394 of 400