Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Identifies the creation of local users via the net.exe command.
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detect use of PDQ Deploy remote admin tool
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Execution of plink to perform data exfiltration and tunneling
Detects audio capture via PowerShell Cmdlet.
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects attempts of decoding encoded Gzip archives via PowerShell.
Detects email exfiltration via powershell cmdlets
Detects a suspicious or uncommon parent processes of PowerShell
Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of 3proxy, a tiny free proxy server
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines
Page 314 of 319