Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.
Detects potentially suspicious file downloads directly from IP addresses using Wget.exe
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Detects suspicious processes including shells spawnd from WinRM host process
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes
Detects the registration of a new ODBC driver.
Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence
Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process
Files with well-known filenames (sensitive files with credential data) copying
Detects the deletion of all backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects the PowerShell command lines with special characters
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
Page 316 of 319