Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
This rule detects the execution of Mimikatz by identifying specific command-line arguments and keywords commonly associated with its various modules and functions. It looks for terms like 'DumpCreds', 'mimikatz', and module-specific keywords such as '::aadcookie', '::detours', 'sekurlsa::', 'kerberos::', and 'lsadump::'. The rule aims to identify attempts to dump credentials or perform other malicious actions using the Mimikatz tool.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
Detects the execution of the Rclone utility, which is often used by ransomware strains like REvil, Conti, and FiveHands for data exfiltration to cloud storage services. The rule looks for specific command-line arguments and image names associated with Rclone.
This rule detects the execution of the `systeminfo.exe` command, which is used to retrieve detailed system information. Adversaries often use this command during the discovery phase to gather information about the compromised system's operating system, hardware, and installed software. This information can help them understand the environment and plan subsequent actions.
This rule detects the creation or modification of a specific registry key associated with Windows Credential Editor (WCE). WCE is a tool used to dump credentials from memory, specifically targeting the Local Security Authority Subsystem Service (LSASS). The rule looks for the string 'Services\WCESERVICE\Start' within the 'TargetObject' field of registry events, indicating the installation or activation of WCE as a service.
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.
Detects the creation of suspicious printer ports that point to executable files or use the 'Generic / Text Only' driver, which can be abused for persistence or execution, often associated with CVE-2020-1048 (PrintDemon).
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
Detects the execution of the `attrib.exe` utility with the `+s` flag, which is used to mark files as system files. This technique can be used by adversaries to hide malicious files from users and some security tools, contributing to defense evasion.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. It is recommended to turn off "Local Group Policy Object Processing" via GPO to ensure Active Directory GPOs take precedence over local/edited computer policies.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
This rule detects the execution of the 'rar.exe' utility with command-line arguments indicating the creation of an archive that is either password-protected ('-hp') or uses a specific compression level ('-m'). This combination of parameters is often associated with malicious activities, such as data exfiltration or staging, where adversaries compress and password-protect data before moving it off a compromised system.
Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects a user log-off activity. This rule can be used to correlate information during forensic investigations by identifying when a user session ends. It specifically looks for Windows Event IDs 4634 (An account was logged off) and 4647 (User initiated logoff).
Detects suspicious WMI event filter and command line event consumer creation or modification based on WMI and Security Logs. This rule specifically looks for EventID 5861 (WMI filter to consumer binding) and EventID 5859 (WMI filter registration) in conjunction with common consumer keywords like 'ActiveScriptEventConsumer' and 'CommandLineEventConsumer'. It excludes legitimate SCM Event Provider activity.
Page 298 of 319