Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,393 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,689
1,317
905
813
744
Platforms
5,922
913
883
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of scheduled tasks by user accounts using the 'schtasks.exe' utility. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' command-line argument, while filtering out activity from common system users to reduce false positives.
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
Bypass UAC via CMSTP
Sigma
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Detects a User Account Control (UAC) bypass technique that leverages the Event Viewer's RecentViews functionality. This method involves manipulating the RecentViews file to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for command-line arguments that reference 'Event Viewer\RecentViews' or 'EventV~1\RecentViews' in conjunction with a redirection operator ('>'), indicating an attempt to write to or modify this file.
Detects the use of WSReset.exe to bypass User Account Control (UAC). This technique allows adversaries to execute privileged processes without a UAC prompt.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The rule specifically looks for modifications to the 'Autorun', 'CleanupString', or 'PreCleanupString' registry values within the 'VolumeCaches' key, combined with specific executable names or common suspicious paths in the 'Details' field.
This rule detects attempts to establish persistence by modifying specific registry keys related to the Windows Event Viewer's redirection functionality. Adversaries can manipulate these keys, specifically 'MicrosoftRedirectionProgram' and 'MicrosoftRedirectionURL', to execute arbitrary programs or open malicious URLs when a user interacts with the Event Viewer. The rule filters out legitimate modifications made by svchost.exe (likely via GPO) for default redirection programs and command-line parameters, as well as the default Microsoft events.asp URL and empty values, to reduce false positives.
Detects a specific UAC bypass technique leveraging Windows Media Player's `osk.exe` by monitoring modifications to a particular registry key. This technique, often associated with UACMe (specifically method 32), involves setting a 'Binary Data' value in the AppCompatFlags\Compatibility Assistant\Store registry path for `C:\Program Files\Windows Media Player\osk.exe`.
Detects the creation of a specific named pipe ('thisispipe') which is known to be used by the DiagTrackEoP Proof-of-Concept tool. This tool exploits the "SeImpersonate" privilege for privilege escalation on Windows systems.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects when the 'windir' environment variable is modified from its default value. This modification is often a precursor to a User Account Control (UAC) bypass technique leveraging the 'SilentCleanup' scheduled task, which is an auto-elevated task that can execute with administrator privileges without prompting the user.
Detects a specific UAC bypass technique (UACMe 52) that abuses a path parsing vulnerability in `winsat.exe`. This bypass involves modifying registry keys related to `winsat.exe` to point to a malicious executable located in a temporary directory, allowing for privilege escalation without a UAC prompt.
Detects usage of the "usermod" binary to add users add users to the root or suoders groups
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Page 396 of 400