Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects service ticket requests using RC4 encryption type
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Detects update to a scheduled task event that contain suspicious keywords.
Detects remote service activity via remote access to the svcctl named pipe
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
User Logoff Event
Sigma
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Locked Workstation
Sigma
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Detects creation of ".vhd"/".vhdx" files by browser processes.
Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
Detects when a user downloads a file by using CertOC.exe
Detects possible payload obfuscation via the commandline
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects usage of the "type" command to download/upload data from WebDAV server
Well-known DNS Exfiltration tools execution
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Page 312 of 319