Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Detects the use of Windows Credential Editor (WCE)
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Files with well-known filenames (sensitive files with credential data) copying
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.
PktMon.EXE Execution
Sigma
Detects execution of PktMon, a tool that captures network packets.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
Shadow Copies storage symbolic link creation using operating systems utilities
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Detection well-known mimikatz command line arguments
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious use of XORDump process memory dumping utility
Page 228 of 229