Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects command-line activities indicative of the uninstallation of Raccine, a ransomware protection tool. It specifically looks for combinations of commands used to terminate Raccine processes, delete its registry entries, and remove its scheduled tasks. The detection logic covers `taskkill` commands targeting `RaccineSettings.exe`, `reg.exe delete` commands referencing "Raccine Tray", and `schtasks /DELETE` commands for "Raccine Rules Updater".
This rule detects executable files created in the Downloads folder that lack common file metadata fields such as FileVersion, Description, Product, or Company. This characteristic is often observed in executables generated by tools like py2exe, which can be used by adversaries to package Python scripts into standalone executables, potentially for malicious purposes. The rule specifically looks for the absence of these fields (indicated by a '?' in the rule logic) in conjunction with the file being located in a user's Downloads directory.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Detects the execution of the LOLBIN (Living Off the Land Binaries and Scripts) `gpscript.exe` when it is used to execute logon or startup scripts configured in Group Policy. This rule specifically looks for `gpscript.exe` being executed with the `/logon` or `/startup` command-line arguments, while filtering out legitimate executions where `gpscript.exe` is parented by `svchost.exe` with the `gpsvc` service.
Detects the use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file when ie4uinit.exe is not run from its usual system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). This behavior is indicative of an adversary attempting to bypass defenses by proxying execution with a trusted system binary.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process". This technique can be used to bypass application control and execute malicious code.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.
This rule detects the use of "ProtocolHandler.exe" to download files from the internet. "ProtocolHandler.exe" is a legitimate Windows binary that can be abused to download files, often placing them in the Internet Explorer cache folder. The detection specifically looks for the execution of "ProtocolHandler.exe" combined with command-line arguments containing common internet protocols like 'ftp://', 'http://', or 'https://'. This behavior is indicative of System Binary Proxy Execution (T1218) where a trusted binary is used to perform malicious actions, potentially bypassing security controls.
Page 305 of 319