Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.
Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.
This rule detects attempts to discover if a process is running inside a Docker container by listing or reading the '.dockerenv' file. Attackers often perform container discovery to understand their environment and plan subsequent actions. The rule specifically looks for common Linux utilities like 'cat', 'ls', 'find', 'dir', 'stat', 'test', or 'grep' being executed with '.dockerenv' in their command line arguments.
Detects the use of the built-in Windows utility 'gpresult.exe' with specific command-line arguments ('/z' or '/v') to display detailed Resultant Set of Policy (RSoP) information. This activity can be indicative of an adversary performing discovery to understand the group policy configuration of a system or domain.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.
Detects the execution of common network scanning or service enumeration tools like telnet, nmap, and netcat on Linux systems, as captured by auditd logs. This activity can indicate an adversary attempting to discover local or remote network services.
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Detects the execution of Nmap or Zenmap, which are network scanning tools. Adversaries commonly use these tools for network service discovery to identify open ports and services on remote hosts, potentially looking for vulnerabilities to exploit.
This rule detects the execution of common Linux commands used for system information discovery. Specifically, it looks for processes ending with '/uname', '/hostname', '/uptime', '/lspci', '/dmidecode', '/lscpu', and '/lsmod'. These commands are frequently used by adversaries to gather details about the operating system, hardware, and loaded modules on a compromised system.
This rule detects the execution of the `systeminfo.exe` command, which is used to retrieve detailed system information. Adversaries often use this command during the discovery phase to gather information about the compromised system's operating system, hardware, and installed software. This information can help them understand the environment and plan subsequent actions.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.
Page 185 of 203