Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool for administering Azure AD and Office 365, which can be abused by threat actors to attack these services. The rule specifically looks for PowerShell processes executing commands containing the unique string "-AADInt" followed by various cmdlet actions like Add, ConvertTo, Disable, Enable, Export, Find, Get, Grant, Initialize, Install, Invoke, Join, New, Open, Read, Register, Remove, Reset, Resolve, Restore, Save, Search, Send, Set, Start, Unprotect, or Update.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
This rule detects attempts to modify the "ChannelAccess" registry key, which controls access permissions for Windows event channels. Adversaries may tamper with these permissions to prevent security tools or analysts from accessing event logs, thereby hindering detection and forensic analysis. The rule specifically looks for modifications to the 'ChannelAccess' key within the 'WINEVT\Channels' registry path and identifies specific Security Descriptor Definition Language (SDDL) strings that grant 'GENERIC ALL' or 'GENERIC WRITE' permissions to local administrators, local system, or built-in administrators. This activity is often a precursor to clearing event logs or otherwise impairing defenses.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
This rule identifies outbound network connections to Autonomous System Numbers (ASNs) that are present in a predefined watchlist named 'suspicious_asn'. It leverages geo-IP enrichment to extract the ASN of the target IP address and compares it against the watchlist. The rule is designed to detect communication with potentially malicious or suspicious network infrastructure.
This rule detects access to the 'wceaux.dll' file, which is associated with the Windows Credential Editor (WCE) tool. This activity is indicative of an attempt to perform pass-the-hash remote command execution, often used for credential dumping and lateral movement. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the accessed object's name ends with '\wceaux.dll'.
This rule identifies outbound network connections to a specific Autonomous System Number (ASN). The rule is designed to detect suspicious network traffic that might indicate command and control activity, data exfiltration, or other malicious communications originating from the monitored environment to an ASN that has been deemed suspicious. The specific ASN to monitor is configured within the rule.
Detects code integrity failures such as missing page hashes or corrupted drivers due to unauthorized modification. This could be a sign of tampered binaries, which adversaries might use for defense evasion or to maintain persistence.
This rule detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is indicative of exploitation of CVE-2024-1708, a path traversal vulnerability (ZipSlip) in ConnectWise ScreenConnect versions prior to 23.9.8. The detection relies on Windows Event ID 4663 (File System) with a SACL set on the directory to log successful access attempts.
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
This rule detects file modifications to the temporary XML user database file within the ScreenConnect server. Such modifications can indicate local user changes, which may occur during the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions prior to 23.9.8. Legitimate modifications to local users or permissions within ScreenConnect can also trigger this detection. This rule requires Advanced Auditing to log successful Windows Event ID 4663 events and a System Access Control List (SACL) set on the relevant ScreenConnect directory.
Detects potential exploitation attempts of an undocumented Windows Server pre-authentication Remote Code Execution (RCE) vulnerability. The rule specifically looks for a new 'svchost.exe' process being created by another 'svchost.exe' process, both running with the '-k DHCPServer' command line argument, and under a Network Service account (covering multiple language settings). This pattern indicates an unusual execution flow that could be indicative of an RCE exploit targeting the DHCP Server service.
Suspicious ASN
YARA-L
Identify network traffic based on a specific ASN
Suspicious ASN Watchlist
YARA-L
Identify any network connections to a list of ASNs
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
Identify network traffic based on target country
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Detects modifications to shell context menu commands within the Windows Registry. This rule is designed to identify potential persistence mechanisms or suspicious activity where an attacker might alter the commands executed when a user interacts with files or folders via the right-click context menu. The detection specifically looks for changes in registry paths containing '\Software\Classes\', '\shell\', and '\command\', which are indicative of context menu command definitions.
Page 291 of 319