Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.
This rule detects the execution of a process where the 'Image' field (representing the executable path) is not a full, absolute path. This behavior can be indicative of techniques like process ghosting or other methods used to start processes in an unorthodox way, often to evade detection. The rule specifically filters out null or empty image paths and common system processes to reduce false positives.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
This rule detects the creation of a WMI script event consumer by monitoring for the execution of 'scrcons.exe' with 'svchost.exe' as its parent process. This specific process relationship is indicative of WMI persistence mechanisms, where a script event consumer is registered to execute code when certain WMI events occur. Adversaries often leverage WMI event consumers for persistence and privilege escalation.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system and allows users to enable or disable individual handlers. It is extensible, allowing developers to implement and register their own disk cleanup handlers. This rule specifically looks for the creation of new registry keys under 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\' which could indicate a malicious handler being registered for persistence, while filtering out known legitimate default entries.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.
Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.
Page 395 of 400