Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,122
15,644
12,592
8,402
6,229
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
WinPEAS is a widely used privilege escalation and discovery tool. This rule detects the execution of winPEAS by monitoring process creation events for specific filenames and command-line arguments. It also looks for command-line options related to information gathering (applications, browser, events, files, processes, services, windows credentials) and attempts to download the tool from its GitHub repository. The rule aims to identify potential privilege escalation attempts and extensive system discovery activities by adversaries.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. The rule looks for common WinPEAS executable names, specific command-line arguments used by WinPEAS for various enumeration tasks, and patterns indicative of downloading WinPEAS PowerShell scripts from GitHub.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
This rule detects the execution of the 'sysctl' command on macOS with specific arguments ('hw.', 'kern.', or 'machdep.'). Threat actors and malware commonly use 'sysctl' with these arguments to gather system hardware information, often as part of virtualization or sandbox evasion techniques. By querying system properties, adversaries can determine if they are operating in an analysis environment and adjust their behavior accordingly.
Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.
Detects the execution of WMIC to enumerate installed firewall, antivirus, and antispyware products. Adversaries often perform this discovery to understand security controls, plan evasion tactics, or disable protection mechanisms.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
This YARA rule detects the BackConnect backdoor by identifying specific byte patterns related to its network communication, system information gathering, DNS server enumeration, and network interface enumeration functionalities. The rule looks for distinct code sequences that are characteristic of how this malware operates.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
This rule detects when a Python process initiates an outbound network connection. While this activity can be legitimate for tasks like package installation or updates, it can also be indicative of malicious behavior, such as a Python-based script establishing communication with a command and control (C2) server or performing network reconnaissance. The rule includes filters to reduce false positives from common activities like Anaconda updates, Jupyter Notebook local communication, and 'pip install' commands.
Detects the execution of 'whoami.exe' when its parent process is not a common legitimate shell or application, or when the parent process information is missing. This can indicate suspicious activity, as 'whoami.exe' is often used by attackers for discovery purposes.
Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Yara rule that detects BackConnect backdoor.
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Detects the execution of whoami.exe with suspicious parent processes.
Page 178 of 203