Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,006 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,006
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
This rule detects suspicious connections to the ADFS database via named pipes. It specifically looks for processes connecting to the `\\MICROSOFT##WID\tsql\query` named pipe on ADFS servers, excluding legitimate ADFS-related processes such as `Microsoft.Identity.Health.Adfs.PshSurrogate.exe`, `Microsoft.IdentityServer.ServiceHost.exe`, `AzureADConnect.exe`, `Microsoft.Tri.Sensor.exe`, `wsmprovhost.exe`, `mmc.exe`, `sqlservr.exe`, and `sqlwriter.exe`. Such connections from unauthorized processes may indicate an attempt to access ADFS for malicious purposes.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
This rule detects when a single user account (principal) assumes the identity of multiple other user accounts (targets) within the OneLogin SSO system. Specifically, it triggers if a user, identified by their `userid`, performs "USER_RESOURCE_ACCESS" events as more than 3 distinct target users within a one-hour window. This behavior can indicate an attacker attempting to gain access to multiple accounts after compromising a single set of credentials, or an insider abusing their privileges.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Detects the execution of the Evil-WinRM hack tool by identifying specific hardcoded strings within PowerShell Module logs. This rule looks for patterns associated with Evil-WinRM's functionality, such as specific PowerShell commands for file operations, binary invocation, and registry queries, executed within the context of wsmprovhost.exe.
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Detects potential use of Rubeus via registered new trusted logon process
This rule detects the execution of 'tscon.exe' with 'System' integrity level. This combination is indicative of potential RDP session hijacking activity, where an attacker takes over an existing RDP session without needing credentials or prompting the user. The 'tscon.exe' utility is a legitimate Windows tool used to connect to or disconnect from a session on a Remote Desktop Session Host server, but its execution with System integrity is a strong indicator of malicious intent in this context.
Detects the execution of SharpMove, a .NET utility used for lateral movement that performs tasks such as task creation, Service Control Manager (SCM) queries, and VBScript execution via WMI. The detection is based on the executable name or original filename and the presence of specific command-line arguments indicating its functionality.
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule looks for specific HTTP POST requests containing 'NO_BINARY_CHECK=1' and 'input.path' in the URI query, ending with '.xsl', and resulting in a 200 or 302 HTTP status code. These patterns are indicative of an attempt to leverage the insecure XML parsing vulnerability.
This rule detects suspicious child processes spawned by Excel.exe, which can indicate lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. Specifically, it looks for child processes with original filenames or image paths ending in 'foxprow.exe', 'schdplus.exe', or 'winproj.exe'. This behavior is associated with DCOM abuse for remote code execution.
Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE, also known as BlueKeep. The detection specifically looks for failed RDP login attempts (EventID 4625) with a TargetUserName of 'AAAAAAA', which is a known signature of this scanner.
This rule detects suspicious errors related to the Remote Desktop Protocol (RDP) that could indicate an attempt to exploit CVE-2019-0708, also known as BlueKeep. It specifically looks for Event IDs 56 or 50 generated by the 'TermDD' provider, which are associated with RDP session errors that can occur during exploitation attempts.
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
Page 89 of 96