Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the execution of 'setspn.exe' with the query flag ('-q' or '/q'), which is commonly used by attackers to enumerate Service Principal Names (SPNs) as a precursor to Kerberoasting attacks. This activity can help identify potential attempts to discover service accounts with weak passwords that can be cracked offline.
Detects access to a file share with a specific naming schema ('\MSHTML_C7\' and an IP address pattern) that has been observed during exploitation of CVE-2023-36884. This rule looks for Windows Security Event ID 5140 (A network share object was accessed) where the ShareName or ShareLocalPath contains the characteristic string and an IP address.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.
This rule detects a potential Kerberos Replay Attack on domain controllers. It specifically looks for Event ID 4649, which indicates that a "KRB_AP_ERR_REPEAT" Kerberos response was sent to the client. This error signifies that the KDC detected a replay of a Kerberos Application Server (AP) request, suggesting an adversary might be attempting to reuse stolen Kerberos tickets to gain unauthorized access.
Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.
Detects when important scheduled tasks are deleted or disabled. Adversaries may delete or disable scheduled tasks to hinder defensive capabilities, stop legitimate services, or prevent forensic analysis. This rule specifically targets tasks related to system restore, Windows Defender, BitLocker, Windows Backup, and Windows Update, which are critical for system integrity and security.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
Detects the execution of the "logman" utility to disable or delete Windows trace sessions, which can be used by adversaries for defense evasion by tampering with logging mechanisms like Sysmon or other kernel loggers.
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
Detects potential process and execution activity related to the APT10 Cloud Hopper operation. Specifically, it looks for `cscript.exe` executing VBScripts with a `/shell` argument and `csvde` commands attempting to export data to a log file in `C:\windows\web\`.
This rule detects suspicious process creation activity involving 'rundll32.exe' executing a DLL from a user's local application data directory, specifically looking for command-line patterns that include '.dat"' or '.dll #1'. This behavior is characteristic of the Sofacy (APT28) Trojan loader. The rule filters out executions from the temporary directory to reduce false positives.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
This rule detects attempts to access specific registry keys associated with the Windows Local Security Authority (LSA) to calculate the SysKey. SysKey is a critical encryption key used to protect sensitive system information, including password hashes. Adversaries may attempt to extract the SysKey to decrypt credentials or other sensitive data stored in the LSA, often as part of credential dumping activities. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the ObjectType is 'key' and the ObjectName ends with 'lsa\JD', 'lsa\GBG', 'lsa\Skew1', or 'lsa\Data'. These registry paths are known locations where SysKey components are stored.
Detects remote service activity by monitoring access to the 'svcctl' named pipe via the IPC$ share. This activity is indicative of an attacker attempting to interact with services on a remote system, often as part of lateral movement or persistence efforts.
Page 300 of 319