Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,006 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,006
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
This rule detects the creation of child processes by SysAidServer, specifically when the parent process is either 'java.exe' or 'javaw.exe' and its command line contains 'SysAidServer'. This activity has been observed in intrusions attributed to the MERCURY (MuddyWater) threat actor, suggesting potential exploitation or unauthorized execution within the SysAid environment.
Detects the execution of the PDQ Deploy Console, which is a remote administration tool. This rule identifies the creation of processes associated with the PDQ Deploy Console based on its description, product name, company, or original file name. This tool can be used for legitimate software deployment but can also be leveraged by adversaries for execution and lateral movement.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
This rule detects the creation of a Java process that is configured for remote debugging, specifically when the debugging interface is bound to an address other than localhost (127.0.0.1 or localhost). This configuration allows external connections to the Java Debug Wire Protocol (JDWP) port, which can be exploited by attackers to gain control over the Java application or the underlying system. The rule looks for the 'transport=dt_socket,address=' string in the command line, combined with the absence of 'address=127.0.0.1' or 'address=localhost'. It also includes a check for older JVM versions ('jre1.' or 'jdk1.') which might be more vulnerable.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Detects the execution of the Radmin Viewer utility, which is a legitimate remote administration tool that can be leveraged by adversaries for remote control and lateral movement within a Windows environment.
Detects when a network share is mounted using the "net.exe" or "net1.exe" utility with the 'use' command, indicating potential lateral movement or data access activity.
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
RDP login with localhost source address may be a tunnelled login
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects an issue in apache logs that reports threading related errors
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Page 93 of 96