Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Local User Creation
Sigma
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects suspicious powershell command line parameters used in Empire
Detects usage of the Sharp Chisel via the commandline arguments
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects password change for the computer's domain account or host principal via "ksetup.exe"
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects process dump via legitimate sqldumper.exe binary
Detects when a share is mounted using the "net.exe" utility
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects nltest commands that can be used for information discovery
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects suspicious Plink tunnel port forwarding to a local port
Detects usage of a base64 encoded "IEX" cmdlet in a process command line
Page 309 of 319