Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,004 detections
Filters
Last updated
All Time
Detection languages
734
639
208
129
126
Contributors
374
315
226
187
119
Categories
564
419
368
284
263
Platforms
1,427
228
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,115
15,635
12,582
8,393
6,221
2,004
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Alerts on Metasploit host's authentications on the domain.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects blocking of process creations originating from PSExec and WMI commands
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects when an admin share is mounted using net.exe
Detects when a share is mounted using the "net.exe" utility
Detects suspicious Plink tunnel port forwarding to a local port
Detects a suspicious RDP session redirect using tscon.exe
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects execution of Impacket's psexec.py.
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects remote service activity via remote access to the svcctl named pipe
Detects the use of smbexec.py tool by detecting a specific service installation
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Page 94 of 96