Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
This rule detects modifications to the Internet Explorer ZoneMap Domains registry key, which can be used to add domains to specific security zones (e.g., Trusted Sites). Adversaries might modify these settings to lower security restrictions for malicious websites or to bypass security prompts.
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Detects potentially suspicious child processes of WinRAR.exe.
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
RDP login with localhost source address may be a tunnelled login
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Detects command line parameters or strings often used by crypto miners
Detects read access to a domain user from a non-machine account
Detects access to ADMIN$ network share
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Detects external disk drives or plugged-in USB devices.
Detects well-known credential dumping tools execution via service execution events
Alerts on Metasploit host's authentications on the domain.
Detects powershell script installed as a Service
Detects non-system users failing to get a handle of the SCM database.
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Page 308 of 319