Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
This rule detects suspicious child processes spawned by Excel.exe, which can indicate lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. Specifically, it looks for child processes with original filenames or image paths ending in 'foxprow.exe', 'schdplus.exe', or 'winproj.exe'. This behavior is associated with DCOM abuse for remote code execution.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.
Detects suspicious parent process for cmd.exe
Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.
Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE, also known as BlueKeep. The detection specifically looks for failed RDP login attempts (EventID 4625) with a TargetUserName of 'AAAAAAA', which is a known signature of this scanner.
This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
This rule detects process creation events where the command line contains a specific, unique string ' uTYNkfKxHiZrx3KJ'. This string is identified as an indicator of compromise associated with the Diamond Sleet APT group, also known as Lazarus Group. The rule aims to identify execution of malicious payloads or commands used by this threat actor.
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path. This behavior is often abused by adversaries to execute malicious DLLs for defense evasion.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could disable these warnings to run malicious Python code within spreadsheets without user notification, leveraging the new Microsoft Excel feature that allows Python execution.
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects the execution of "AccCheckConsole.exe" with command-line arguments indicative of its use for UI accessibility checking, which can be abused to load malicious DLLs. This utility allows providing a custom DLL containing a "verification routine" via the command line, enabling an attacker to inject and execute arbitrary code within the context of the legitimate `AccCheckConsole` process.
Page 294 of 319