Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects potential path traversal attempts via cmd.exe, which could indicate command or argument confusion/hijacking. The rule looks for cmd.exe being executed with command line arguments containing '/c', '/k', or '/r' and a path traversal sequence like '/../../'.
Detects the use of the 'Ilasm.exe' utility to compile C# Intermediate Language (IL) code into executable (EXE) or dynamic-link library (DLL) files. This activity can be indicative of an adversary compiling malicious code on a compromised system, potentially to bypass security controls or execute custom payloads.
This rule detects attempts to bypass Antimalware Scan Interface (AMSI) functionalities by using specific strings or NULL bits in command-line arguments. Adversaries often employ such techniques to obfuscate malicious scripts or commands, preventing security products from detecting and blocking them. The rule specifically looks for patterns like "if(0){{{0}}}' -f $(0 -as [char]) +" and "#<NULL>" in the command line, which are known indicators of AMSI bypass attempts.
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.
Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
Detects modifications to the 'User Shell Folders' registry key, specifically targeting the 'Startup' value. This key can be manipulated by adversaries to achieve persistence by launching malicious payloads during system startup.
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Page 304 of 319