Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects python spawning a pretty tty
Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Use of reg to get MachineGuid information
Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).
Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Detect attacker collecting audio via SoundRecorder application.
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Detects possible execution via LNK file accessed on a WebDAV server.
Page 315 of 319