Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe. This rule looks for executions of 'wget.exe' where the command line includes an IP address, 'http', and specific suspicious paths often used for temporary files or public user directories. This could indicate an adversary downloading malicious tools or files directly to a system.
Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Detects the execution of a system command via the ScreenConnect RMM service.
Detects potential web shell execution from the ScreenConnect server process.
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
This rule detects potential secure deletion activity using SDelete by monitoring Windows Security Event IDs 4656, 4663, and 4658 for file objects ending with '.AAA' or '.ZZZ'. These extensions are commonly associated with SDelete's file wiping process, where it renames files with these extensions during secure deletion to prevent recovery.
Detects potential use of Rubeus via registered new trusted logon process
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Detects the execution of EDRSilencer, a tool that manipulates the Windows Filtering Platform (WFP) to block outbound network traffic from EDR agents. This is identified by monitoring Windows Security Event IDs 5441 (A Windows Filtering Platform filter has been added) or 5447 (A Windows Filtering Platform filter has been changed) in conjunction with the specific filter name 'Custom Outbound Filter' used by EDRSilencer.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions. This activity is often performed by adversaries during the discovery phase to understand the compromised environment.
This rule detects attempts to escalate privileges by modifying Windows service configurations using 'sc.exe' from a non-administrative context (Medium integrity level). Specifically, it looks for modifications to a service's 'binPath' (ImagePath) or 'FailureCommand', which could allow an attacker to execute arbitrary code with elevated privileges when the service starts or fails.
Detects the execution of Accesschk.exe, a Sysinternals utility used for auditing permissions. Adversaries often abuse this tool to discover privileges and access rights on a system, which can aid in privilege escalation or further discovery within the environment.
Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.
Detects a User Account Control (UAC) bypass technique leveraging Windows Media Player's `osk.exe` in conjunction with `cmd.exe` and `mmc.exe` to achieve elevated privileges. This specific pattern is associated with UACMe bypass method 32, which exploits the `osksupport.dll` vulnerability. The rule looks for the creation of `osk.exe` from the Windows Media Player directory, followed by `cmd.exe` being launched with a specific parent command line involving `mmc.exe` and `eventvwr.msc`, all while maintaining a high or system integrity level.
Detects a specific User Account Control (UAC) bypass technique known as "IDiagnosticProfileUAC". This technique involves a process with high or system integrity level launching 'DllHost.exe' with a specific command-line argument containing '{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'. This behavior is indicative of an attempt to elevate privileges by bypassing UAC.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
This rule detects the creation of processes with specific SHA1 or SHA256 hashes that have been identified as indicators of compromise (IOCs) associated with the GALLIUM cyber espionage group. These hashes correspond to known malicious executables used by the group. The detection is based on a report by Microsoft Threat Intelligence Center from December 2019, which detailed GALLIUM's targeting of global telecommunications.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.
Page 292 of 319