Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detection of unusual child processes by different system processes
Detects suspicious process patterns used in NTDS.DIT exfiltration
Shadow Copies creation using operating systems utilities, possible credential access
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
Detects PowerShell script execution from Alternate Data Stream (ADS)
Detects suspicious PowerShell invocation with a parameter substring
Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Page 319 of 319