Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Detects the execution of the `wmic.exe` utility with the `computersystem` flag to gather information about the machine, such as domain, username, and model. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
This rule detects the NjRAT backdoor, a remote access Trojan (RAT). It identifies two main versions of the malware based on distinct byte patterns related to persistence mechanisms, command and control (connect, send, receive) functionalities, and system information gathering. The rule looks for specific sequences of bytecode instructions indicative of NjRAT's operational logic.
Detects suspicious command with /dev/tcp
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects usage of "find" binary in a suspicious manner to perform discovery
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Detects read access to a domain user from a non-machine account
Detects non-system users failing to get a handle of the SCM database.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Page 191 of 203