Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects attempts to discover local user accounts and system owner/user information using various Windows command-line utilities. It specifically looks for the execution of `cmd.exe` with `dir \users\` (excluding `rmdir`), `net.exe` or `net1.exe` with `user` (excluding common account management actions), `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with `useraccount get`, and `cmdkey.exe` with `/l`. These commands are frequently used by adversaries to gain situational awareness about the system's users.
This rule detects the execution of `createdump.exe`, a legitimate utility, when it is used to dump process memory. The detection is based on the presence of specific command-line arguments such as '-u', '--full', '-f', '--name', or '.dmp', which are indicative of memory dumping operations. This activity is often associated with attempts to extract credentials or other sensitive information from running processes.
This rule detects attempts to dump the Local Security Authority Subsystem Service (LSASS) memory using `rundll32.exe` to call the `MiniDump` export function from `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from a compromised system.
This rule detects network connections initiated by a process over ports 5985 (HTTP) or 5986 (HTTPS), which are commonly used for Windows Remote Management (WinRM) and PowerShell Remoting. The rule specifically looks for these connections originating from non-network service accounts, as connections from such accounts could indicate a suspicious remote PowerShell session. It excludes connections from localhost and known legitimate antivirus processes to reduce false positives.
This rule detects the execution of PowerShell commands that utilize the `System.Net.WebClient` object to download files using the `DownloadFile` method. This is a common technique used by adversaries to retrieve malicious payloads or tools from remote servers.
This rule detects the creation of a file named 'dumpert.dmp' which is the default output file name used by the Outflank Dumpert tool. Outflank Dumpert is a known tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, typically for credential harvesting.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
Detects the usage of the "ConvertTo-SecureString" cmdlet via the command line within PowerShell or pwsh.exe processes. This activity is generally uncommon and could indicate suspicious behavior, as it is often used to handle sensitive information like passwords, which attackers might try to extract or manipulate.
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, which is a common technique for credential access.
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
Detects suspicious uses of the SysInternals Procdump utility by using specific command line parameters (`-ma` or `-mm`) in combination with the `lsass.exe` process. This rule aims to catch instances where an attacker might rename the Procdump executable but still uses its characteristic command-line arguments to dump LSASS memory. It covers scenarios described in atomic tests 1 and 8 related to Procdump memory dumping.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows administrative shares (like C$, ADMIN$) or the SYSVOL folder. This activity can indicate lateral movement or data staging by an adversary.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This rule detects the execution of the `finger.exe` utility on Windows systems. `finger.exe` is an old utility used to display information about users on a specified remote computer running the finger service. Given its age and the rarity of the finger service on modern systems, any execution of this utility is considered suspicious and warrants investigation.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
Page 390 of 465