Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
This rule detects attempts to enumerate Active Directory groups and user properties using specific PowerShell cmdlets. It looks for the use of 'get-ADPrincipalGroupMembership' to identify group memberships and 'get-aduser' with specific parameters ('-f', '-pr', 'DoesNotRequirePreAuth') which can be used to discover user attributes relevant for privilege escalation or further reconnaissance. This activity is often performed by adversaries to map out the domain environment and identify accounts with elevated privileges.
This rule detects the execution of the 'Get-NetTCPConnection' PowerShell cmdlet. This cmdlet is used to retrieve information about TCP connections on a system. Adversaries may use this for system network connections discovery to understand the network environment of a compromised host.
This rule detects the execution of a PowerShell command that specifically enumerates browser bookmarks. It looks for the use of 'Get-ChildItem' with parameters '-Recurse', '-Path', '-Filter Bookmarks', '-ErrorAction SilentlyContinue', and '-Force'. This activity is indicative of an adversary attempting to discover information about the compromised host by collecting browser bookmark data, which can reveal personal information or details about internal network resources.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.
Detects the use of dtrace.exe to perform a kernel dump on Windows systems. This activity is suspicious as dtrace.exe is a legitimate debugging tool that can be abused for system information discovery or credential access by dumping kernel memory.
This rule detects the execution of the `hostname.exe` utility. Adversaries often use this command-line tool to gather information about the compromised system, specifically its hostname, as part of their discovery phase. This activity is typically a precursor to further malicious actions.
This rule detects attempts to discover network connections on a system using the built-in Windows `net.exe` or `net1.exe` utility with the `use` or `sessions` commands. Adversaries often use these commands to map out network resources and active user sessions on compromised systems.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
This rule detects the execution of 'where.exe' with command-line arguments that indicate an attempt to locate sensitive browser data files. Adversaries may use this technique to discover personal information, credentials, or internal network details stored by web browsers.
Detects the execution of WMIC with the "csproduct" argument, which is used by adversaries to obtain information such as hardware models and vendor details from a system. This can be part of reconnaissance activities.
This rule detects the execution of the PowerShell cmdlet 'Get-NetTCPConnection', which adversaries may use to discover network connections on a compromised system. This activity is often part of the discovery phase in an attack chain, where an attacker gathers information about the network environment.
Detects PowerShell scripts that enumerate installed hotfixes by querying 'Win32_QuickFixEngineering' and looking for 'HotFixID'. This activity is often performed by attackers during the discovery phase to gather system information.
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects the execution of 'dsquery.exe' with command-line arguments indicative of domain trust discovery. This activity is often performed by adversaries to map out the network environment and identify potential lateral movement paths within multi-domain Active Directory environments.
Detects the usage of "findstr" with the argument "385201", which is the default driver altitude for Sysinternals Sysmon. This activity could indicate an adversary attempting to discover if Sysmon is installed on a system, even if the service name has been changed.
Page 189 of 203