Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
This rule detects the execution of the legitimate tool 'Mouse Lock' based on its product name, company name, or command line arguments. According to Kaspersky's 2020 Incident Response Analyst Report, this tool has been observed being used by adversaries for credential access and data collection in security incidents, making it a potentially unwanted application (PUA) in a security context.
Detects a command used by the Conti ransomware group to list volume shadow copies and redirect the output to a log file. This activity is often a precursor to deleting shadow copies to prevent system recovery.
Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.
Detects logon events (Event ID 4672 and 4964) involving accounts with special privileges or belonging to special groups, such as administrators. The rule filters out the local system account (S-1-5-18) and allows for a configurable filter for valid internal accounts to reduce false positives.
This rule detects the installation of the 'HybridConnectionManager' service on a Windows system. This service is part of Azure Hybrid Connection Manager, which allows Azure services to connect to on-premises resources. While legitimate, its installation could also be leveraged by an attacker to establish persistence or facilitate data exfiltration from an compromised environment to Azure resources.
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.
Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. This key is created when a Sysinternals tool is run for the first time and the End User License Agreement (EULA) is accepted.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
Detects a command line pattern used by the Conti ransomware group to archive and stage the NTDS.dit database for exfiltration. The rule specifically looks for the execution of '7za.exe' (7-Zip archiver) with a command line that includes '\C$\temp\log.zip', indicating the creation of a zip archive in a temporary location, a common step before exfiltration.
This rule detects the execution of the 'tasklist' command, which adversaries may use to gather information about running processes on a system. This information can help them understand the system's environment and identify potential targets or further actions.
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
Detects the creation of suspicious local accounts that mimic the 'ANONYMOUS LOGON' account, potentially using additional spaces or other obfuscation techniques. This rule specifically targets Event ID 4720 (A security-enabled local group was created) and looks for 'ANONYMOUS' and 'LOGON' within the SamAccountName field, aiming to cover scenarios where such accounts are created to bypass detection or for malicious persistence.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Page 299 of 319