Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,008 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,008
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects WannaCry ransomware activity
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Detects when an admin share is mounted using net.exe
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects blocking of process creations originating from PSExec and WMI commands
Detects the use of smbexec.py tool by detecting a specific service installation
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detect suspicious error on protocol RDP, potential CVE-2019-0708
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network.
This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects remote service activity via remote access to the svcctl named pipe
Page 79 of 96