Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Detects attempts to decompress Gzip archives using PowerShell's GZipStream::Decompress method. This technique can be used by adversaries to unpack malicious payloads that have been compressed to evade detection.
This rule detects the execution of `rundll32.exe` with the `InstallScreenSaver` command-line argument. This technique can be abused by attackers to execute arbitrary applications as a screensaver file (.scr) for defense evasion, as `rundll32.exe` is a legitimate Windows utility. The rule specifically looks for `rundll32.exe` (or its original filename) and the `InstallScreenSaver` string in the command line.
Detects the stopping of a Windows service using the built-in 'sc.exe' utility. This rule specifically looks for process creation events where 'sc.exe' is executed with the 'stop' command-line argument. While 'sc.exe' is a legitimate system tool, its use to stop services can be indicative of malicious activity, especially when combined with other suspicious behaviors, as adversaries may stop services to disrupt operations, evade defenses, or facilitate data destruction/encryption.
This rule detects suspicious patterns in program names or command-line arguments that are commonly associated with malicious samples, hacktools, or exploit kits. It looks for specific keywords and file names in the 'Image' (executable path) and 'CommandLine' fields. Examples include CVE-related strings, common exploit/artifact names like 'poc.exe', 'meterpreter', and various PowerShell scripts often used in post-exploitation such as 'inject.ps1', 'Invoke-CVE', 'mimikatz.ps1', and 'powercat.ps1'.
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.
This rule detects the execution of PowerShell code through the `sqltoolsps.exe` utility, which is part of Microsoft SQL Server Management Studio. This method can be used to bypass logging mechanisms for script blocks, making it a technique for defense evasion.
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Detects the pattern of User Account Control (UAC) Bypass using the ICMLuaUtil Elevated COM interface. This technique involves a specific parent process (dllhost.exe) launching with particular Process IDs associated with the ICMLuaUtil interface, which can be abused to elevate privileges without user interaction. The rule filters out legitimate WerFault.exe processes to reduce false positives.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
Page 303 of 319