Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,006 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,006
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects default CSExec pipe creation
Detects remote PowerShell sessions
Detects remote PowerShell sessions
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Detects RDP session hijacking by using MSTSC shadowing
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Detect use of PDQ Deploy remote admin tool
Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
Detects default RemCom pipe creation
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Page 95 of 96