Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects suspicious execution of Microsoft HTML Help (hh.exe) when it is launched from unusual or temporary directories, or with command-line arguments indicating potential malicious activity. Adversaries often abuse hh.exe to execute malicious code embedded within Compiled HTML (CHM) files, leveraging it as a living-off-the-land binary to bypass defenses and execute payloads. The rule specifically looks for hh.exe being executed from common temporary or user download paths, which are frequently used for initial access or staging.
Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
Detects potential credential dumping via the Windows Error Reporting (WER) LSASS Shtinkering technique. This technique abuses WerFault.exe to dump the LSASS process memory. The rule specifically looks for WerFault.exe being executed with command-line arguments indicating a dump of a target process (-p) that is not the source process (-ip), and where the target process is likely LSASS.
Detects an attempt to execute code or create a service on a remote host using `winrm.vbs` via `cscript.exe`. This technique leverages Windows Remote Management (WinRM) to interact with WMI for remote execution, often for lateral movement or persistence.
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects patterns associated with DarkSide Ransomware and its helper processes. Specifically, it looks for command-line arguments used by DarkSide, such as '=[char][byte]('0x'+' or ' -work worker0 -path ', or the execution of an image from the 'AppData\Local\Temp\' directory when the parent process is 'DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
This detection identifies suspicious access attempts to registry keys and sub-keys associated with Azure AD Health service agents, such as AD FS. Gaining access to this information could enable an adversary to abuse features provided by these cloud services, particularly federation. The rule requires specific System Access Control List (SACL) auditing to be configured on 'HKLM:\SOFTWARE\Microsoft\ADHealthAgent' with propagation to sub-keys.
This rule detects the creation of a new Windows service (EventID 4697) where the service's file name contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS OBFUSCATION technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either 'system.io.compression.deflatestream' or 'system.io.streamreader'. This combination suggests an attempt to decompress and execute obfuscated PowerShell code.
Detects obfuscated PowerShell execution initiated via rundll32.exe, specifically looking for the combination of 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell' within the ServiceFileName field of Windows Security Event ID 4697 (Service Creation). This technique is often used for defense evasion and to execute malicious PowerShell scripts.
Detects obfuscated PowerShell execution initiated via rundll32.exe. This rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName contains specific keywords indicative of rundll32.exe being used to execute obfuscated commands, potentially involving PowerShell.
This rule detects when an authenticated user, who is not authorized for remote logon, attempts to connect to a computer via Remote Desktop. This event can indicate an attacker attempting to discover and access available Windows servers on the network.
Detects the registration of the VSSAudit security event source, which typically occurs during volume shadow copy operations. This can be indicative of credential dumping attempts, specifically targeting the Security Account Manager (SAM) database.
Detects workstation session lock events that occur automatically after a standard period of inactivity. This event indicates that a user's session has been locked, typically due to inactivity or a manual lock action. While often a security measure, monitoring these events can help identify unusual patterns of workstation locking, which might precede or follow other suspicious activities, or indicate policy compliance issues.
This rule detects the use of the `attrib.exe` utility to hide files by setting the hidden attribute (`+h`). Adversaries often use this technique to conceal malicious files or directories from users and basic forensic analysis, aiding in defense evasion. The rule specifically looks for the execution of `attrib.exe` with the `+h` command-line argument.
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
This rule detects the use of DataSvcUtil.exe, a legitimate Microsoft utility, with command-line arguments indicative of data exfiltration. Specifically, it looks for the presence of '/in:', '/out:', and '/uri:' parameters in the command line, combined with the execution of 'DataSvcUtil.exe'. This behavior is often associated with Living Off The Land Binaries (LOLBAS) techniques where adversaries leverage legitimate system tools for malicious purposes, in this case, to exfiltrate data.
Page 302 of 319