Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects potential token impersonation and theft on Windows systems. This rule specifically looks for successful logon events (EventID 4624) with a LogonType of 9 (NewCredentials), where the LogonProcessName is 'Advapi' and the AuthenticationPackageName is 'Negotiate', combined with an ImpersonationLevel indicating impersonation. This combination of events is indicative of an attempt to duplicate and impersonate an existing access token, often used for privilege escalation or defense evasion.
This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
Detects the execution of Netcat (nc.exe, ncat.exe, netcat.exe) with suspicious command-line arguments often associated with establishing listener modes, reverse shells, or proxy connections. Netcat is a versatile networking utility that can be used by adversaries for command and control (C2) communication, data exfiltration, or creating backdoors, often leveraging non-application layer protocols.
RDP login with localhost source address may be a tunnelled login
Detects the use of the 'spoolss' named pipe over SMB, which can be leveraged to trigger NTLM authentication from a target machine with the print spooler service enabled. This technique is often used in NTLM relay attacks or other forms of printer spooler abuse to gain unauthorized access or escalate privileges.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
Detects PowerShell commands attempting to load .NET assemblies reflectively using Base64 encoded strings. This technique is often used by adversaries to execute malicious code in memory, evading disk-based detections.
This rule detects attempts to coerce authentication using the PetitPotam technique. It specifically looks for Windows Security Event ID 5145, which indicates a network share access, where the ShareName starts with '\\' and ends with '\IPC$', the RelativeTargetName is 'lsarpc', and the SubjectUserName is 'ANONYMOUS LOGON'. This combination of events is indicative of a PetitPotam attack attempting to force a domain controller to authenticate to a malicious server.
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
This rule detects potential password spraying attempts that leverage the built-in Windows utility `dsacls.exe`. Specifically, it looks for executions of `dsacls.exe` where the command line includes both the `/user:` and `/passwd:` arguments, indicating an attempt to bind to an LDAP session with specified credentials. This technique can be used by attackers to test a single password against multiple user accounts to avoid account lockouts.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
Detects the installation of a well-known TAP driver service, specifically looking for the 'tap0901' service file name. This activity could indicate preparation for data exfiltration using tunneling techniques, as TAP drivers are often used by VPN software like OpenVPN to create virtual network interfaces.
Detects the creation of local user accounts on Windows servers. In environments utilizing Active Directory, local user creation on member servers is generally an anomalous event and could indicate an adversary establishing persistence or creating backdoor accounts. This rule is specifically designed for Windows server logs and should not be applied to Domain Controller logs, as local user creation on DCs is not applicable.
Detects the use of the built-in Windows utility 'gpresult.exe' with specific command-line arguments ('/z' or '/v') to display detailed Resultant Set of Policy (RSoP) information. This activity can be indicative of an adversary performing discovery to understand the group policy configuration of a system or domain.
Detects the use of the 'reg.exe' utility to delete SafeBoot registry keys. This activity is often performed by attackers to disable security products or interfere with system recovery mechanisms, particularly in the context of defense evasion.
Page 296 of 319