Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects the use of common Linux utilities such as 'find', 'tree', 'findmnt', 'ls -R', and 'mlocate' for discovering files, directories, and potentially network shares. This activity is often performed by adversaries to gain situational awareness of the file system.
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information. The rule specifically looks for command-line arguments related to building caches, dumping bloodhound data, certificate dumping, and DNS dumping, combined with arguments for cache filenames or output directories.
Detects system discovery activity carried out by Pikabot, such as network, user information, and domain groups. The malware Pikabot has been observed using this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute). The rule specifically looks for `ipconfig.exe /all`, `netstat.exe -aon`, and `whoami.exe /all` commands executed by processes whose grandparent image ends with `rundll32.exe` or parent image ends with `SearchFilterHost.exe` or `SearchProtocolHost.exe`.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions. This activity is often performed by adversaries during the discovery phase to understand the compromised environment.
Detects the execution of Accesschk.exe, a Sysinternals utility used for auditing permissions. Adversaries often abuse this tool to discover privileges and access rights on a system, which can aid in privilege escalation or further discovery within the environment.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Detects password policy discovery commands
Yara rule that detects CyberVolk ransomware.
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
This rule detects the execution of the `system_profiler` utility on macOS when specific data types are requested. These data types (SPApplicationsDataType, SPHardwareDataType, SPNetworkDataType, SPUSBDataType) have been observed in use by threat actors and malware for system information discovery and potentially for defense evasion by checking for virtualization software. The `system_profiler` command provides detailed hardware and software configuration information about the system.
Detects the use of `csrutil` with the `status` argument to view the System Integrity Protection (SIP) status on macOS. This activity is often observed in post-exploitation scenarios where an adversary is attempting to understand the system's security posture, specifically whether SIP is enabled or disabled, which could impact their ability to perform certain actions like modifying system files or injecting code.
This rule detects the use of the `ioreg` command-line utility on macOS, which is used to display I/O Kit registry information. Adversaries often use `ioreg` for system information discovery, particularly to identify virtualization environments (e.g., VirtualBox, VMware, Parallels) or other system details like serial numbers or USB device information. The rule specifically looks for executions of `ioreg` combined with common arguments and keywords used for such discovery, either directly or through shell commands involving `grep`.
Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.
This rule detects the execution of the 'sw_vers' command-line utility on macOS systems when specific arguments are used to query system information. The arguments monitored include '-buildVersion', '-productName', and '-productVersion', which are commonly used for system information discovery.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Page 182 of 203