Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This detection identifies suspicious access attempts to registry keys and sub-keys associated with Azure AD Health service agents, such as AD FS. Gaining access to this information could enable an adversary to abuse features provided by these cloud services, particularly federation. The rule requires specific System Access Control List (SACL) auditing to be configured on 'HKLM:\SOFTWARE\Microsoft\ADHealthAgent' with propagation to sub-keys.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
Detects the execution of 'nltest.exe', a Windows command-line utility that can be used by adversaries for information discovery, specifically to enumerate domain trusts and discover system network configurations.
This rule identifies the use of `net.exe`, `net1.exe`, or `w32tm.exe` commands to query system time or time zone information. Adversaries may use these commands to gather information about a target system's time settings, potentially before executing scheduled tasks or to understand the system's geographical context.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
This rule detects the use of 'w32tm.exe' with specific command-line arguments that allow it to act as a delay mechanism. Adversaries may leverage this legitimate Windows utility to introduce delays in their execution, potentially for sandbox evasion or to time their activities. The detected command-line arguments include '/stripchart', '/computer:', '/period:', '/dataonly', and '/samples:'.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Detects the usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dll" DLL. This DLL is often used by attackers to perform Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) are not installed or administrative privileges are not available.
This rule detects the execution of the PowerShell cmdlet 'Get-GPO'. This cmdlet is used to retrieve information about Group Policy Objects (GPOs) in a domain. Adversaries may use this for discovery purposes to understand the domain's policy configurations, which can aid in identifying potential privilege escalation paths or misconfigurations.
Detects the usage of 'reg.exe' to query reconnaissance information from the Windows registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software, specifically looking for common persistence mechanisms and service configurations.
Detects a suspicious process command line where 'whoami' is used as the first parameter, which can be indicative of privilege escalation techniques like those used by EfsPotato. This rule specifically looks for '.exe whoami' in the command line.
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
This rule detects PowerShell script execution that attempts to enumerate installed software on a Windows system. Specifically, it looks for the combination of `Get-ItemProperty`, `\software\`, `Select-Object`, and `Format-Table` within the PowerShell script block text. This pattern is commonly used to query the registry for installed applications under `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\` and format the output.
Detects the execution of 'netsh.exe' with the 'trace' and 'start' flags, indicating that a network trace capture has been initiated. This activity can be used by adversaries for network sniffing to gather information about the environment, including credentials or network configurations.
Detects the execution of AdFind with command-line flags commonly associated with reconnaissance activities during attacks. AdFind is a legitimate tool that can be abused by adversaries to gather extensive information about Active Directory environments, including domain trusts, user accounts, computer objects, and group policies.
Page 188 of 203