Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects changes to the \"DisableRestrictedAdmin\" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects modification of autostart extensibility point (ASEP) in registry
Detects potential PowerShell commands or code within registry run keys
Detects suspicious process access to the Local Security Authority Subsystem Service (LSASS) memory. The rule specifically looks for processes attempting to access LSASS with certain access flags from potentially suspicious folders like temporary directories or user application data folders. This behavior is indicative of credential dumping attempts, often performed by malware or attackers to harvest credentials.
The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. It leverages data from Endpoint Detection and Response (EDR) agents, specifically monitoring changes to the registry path associated with Windows Defender reporting. This activity is significant because disabling Enhanced Notifications can prevent users and administrators from receiving critical security alerts, potentially allowing malicious activities to go unnoticed. If confirmed malicious, this action could enable an attacker to bypass detection mechanisms, maintain persistence, and escalate their activities without triggering alerts.
The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\Environment\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
The analytic identifies DNS queries to domains associated with the 3CX supply chain attack. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.
The analytic detects the creation of suspicious registry entries by Qakbot malware. These entries are characterized by 8 random hexadecimal registry value names with encrypted binary data, typically found under the "SOFTWARE\\Microsoft\\" path. The detection focuses on processes like explorer.exe, wermgr.exe, dxdiag.exe, OneDriveSetup.exe, mobsync.exe, msra.exe, and xwizard.exe making these modifications. This activity is a strong indicator of a Qakbot infection, as the malware uses the registry to store malicious code or configuration data, enabling persistence and arbitrary code execution on compromised systems.
This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.
The analytic detects changes to the PowerShell ExecutionPolicy in the registry to "Unrestricted" or "Bypass." This activity is significant because setting the ExecutionPolicy to these values can allow the execution of potentially malicious scripts without restriction. If confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges.
The analytic identifies changes to the Directory Services Restore Mode (DSRM) account behavior via registry modifications. It detects alterations in the registry path "*\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior" with specific values indicating potential misuse. This activity is significant because the DSRM account, if misconfigured, can be exploited to persist within a domain, similar to a local administrator account. If confirmed malicious, an attacker could gain persistent administrative access to a Domain Controller, leading to potential domain-wide compromise and unauthorized access to sensitive information.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Detects the execution of mshta.exe with command-line arguments that include file extensions not typically associated with HTML Application (HTA) content, such as image files (.png, .jpg), archives (.zip), documents (.pdf), and others. This behavior is often indicative of adversaries abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
This rule detects the execution of Mimikatz or Mimikatz-like tools by looking for specific command-line arguments commonly used by the tool. Mimikatz is a well-known post-exploitation tool used to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. The rule identifies various Mimikatz modules and commands such as "dumpcreds", "mimikatz", "::aadcookie", "::detours", "::memssp", "::mflt", "::ncroutemon", "::ngcsign", "::printnightmare", "::skeleton", "::preshutdown", "::mstsc", "::multirdp", "rpc::", "token::", "crypto::", "dpapi::", "sekurlsa::", "kerberos::", "lsadump::", "privilege::", "process::", and "vault::". Detection of these arguments indicates an attempt to perform credential access or privilege escalation.
This rule detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process using `WerFault.exe`. It specifically looks for `WerFault.exe` accessing `lsass.exe` with a specific access mask (`0x1FFFFF`), which is indicative of memory dumping tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr. This technique is often used by adversaries to extract credentials for lateral movement or persistence.
This rule detects the execution of PowerShell commands that utilize the `FromBase64String` function. This function is commonly used by adversaries to decode base64 encoded strings, which often contain obfuscated malicious commands or payloads. The rule specifically looks for the string `::frombase64string(` in the command line arguments of a process.
This rule detects the presence of keywords related to LSASS (Local Security Authority Subsystem Service) memory dumping in process command lines. Adversaries often dump LSASS memory to extract credentials such as plaintext passwords, NTLM hashes, and Kerberos tickets. The rule specifically looks for combinations of "lsass" with dump file extensions like ".dmp", ".zip", ".rar", or other common dump-related keywords like "lsassdump", "lsassdmp", "nanodump", and "sqldmpr". This activity is a strong indicator of an attempt to steal credentials from the system.
Detects the suspicious execution of `certreq.exe` with specific command-line arguments that indicate an attempt to download files. This technique is documented in LOLBAS (Living Off The Land Binaries and Scripts) as a method for adversaries to transfer files into a compromised environment, bypassing traditional security controls.
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
Identifies the creation of local users via the net.exe command. This rule specifically looks for process creation events where 'net.exe' or 'net1.exe' is executed with the 'user' and 'add' arguments in the command line.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
Page 389 of 465