Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts to dump process memory, specifically targeting the Local Security Authority Subsystem Service (LSASS) process, using `rundll32.exe` and `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from memory. The rule looks for `rundll32.exe` executing with `comsvcs.dll` and specific keywords like 'full', 'minidump', or numerical arguments (e.g., '24', '#-') that indicate a memory dump operation.
This rule detects the execution of the `createdump.exe` utility, or a renamed version of it, when used to dump process memory. It specifically looks for command-line arguments indicative of memory dumping, such as combinations of `-u`, `-f`, and `.dmp` or `--full`, `--name`, and `.dmp`. The rule explicitly excludes instances where the executable is named `createdump.exe` to focus on renamed binaries, which is a common evasion technique.
Detects the execution of `certutil.exe` with specific command-line arguments (`urlcache` or `verifyctl`) combined with an HTTP URL, indicating an attempt to download files using this utility. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
Detects the execution of Dumpert, a tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process. This rule identifies Dumpert activity by looking for specific import hashes (imphash) associated with the tool or by detecting the string "dumpert.dll" in the command line of a launched process.
This rule detects potential DLL sideloading by identifying the loading of specific system DLLs from non-standard, non-system locations. Adversaries often use DLL sideloading to execute malicious code by placing a malicious DLL in a directory where a legitimate application will load it instead of the intended system DLL. The rule includes a comprehensive list of DLLs commonly abused in sideloading attacks and filters out legitimate loads from known system directories to reduce false positives.
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This rule detects when an executable file (.exe) creates another executable file (.exe). This behavior can be indicative of malicious activity such as malware dropping its components, or legitimate software installers. The rule includes extensive filters to reduce false positives from common system processes, update utilities, and known application behaviors like those from Microsoft Teams, VS Code, and GitHub Desktop.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
Detects the execution of Impacket's wmiexec.py tool by identifying characteristic command-line arguments and temporary file creation patterns. Specifically, it looks for process launches with command lines redirecting output to a hidden ADMIN$ share path (e.g., `1>\ADMIN$\__... 2>&1`) or the creation of files in the `\windows\__` directory, which are common artifacts left by wmiexec.py.
This rule detects the execution of specific 'net group' and 'net localgroup' commands that are commonly used for Active Directory enumeration. These commands are often leveraged by adversaries to discover domain-level groups, local administrator groups, and domain administrator groups, which can help them identify privileged accounts and plan further attacks. The rule is designed to flag multiple occurrences of these commands within a 15-minute window on a single host, as a single execution might be benign, but repeated executions suggest reconnaissance activity. The detection logic specifically looks for 'net localgroup administrators', 'net group /dom', and 'net group Domain Admins /dom', optionally preceded by 'cmd /c'.
Detects attempts to clear Windows Event Logs using 'wevtutil' command-line utility or PowerShell cmdlets like 'Remove-EventLog' and 'Clear-EventLog'. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
This rule detects PowerShell commands that utilize encoded arguments such as '-enc', '-ec', or '-en'. Adversaries often use encoded PowerShell commands to obfuscate their malicious scripts, making it harder for security tools and analysts to detect and understand their activities. The rule specifically looks for the execution of 'powershell.exe' or 'powershell_ise.exe' with these encoding flags and attempts to capture and decode the obfuscated command.
This rule detects various network enumeration commands commonly used by adversaries for reconnaissance, as identified in the CISA Living off the Land report. It specifically looks for commands like 'arp -a', 'curl www.ip-api.com', 'dnscmd /enumrecords', 'dnscmd /enumzones', 'ipconfig /all', 'netsh' commands related to firewall and portproxy, and 'netstat -ano'. Additionally, it detects DNS queries for 'www.ip-api.com', which can be indicative of C2 frameworks like Covenant attempting to check for internet connectivity or external IP addresses.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
Detects the creation of the default output filename used by the wmiexec tool, which is part of the Impacket toolkit. This typically indicates lateral movement or execution of commands via WMI.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
This rule detects when 'amsi.dll' is loaded by processes that are not commonly expected to load it. AMSI (Antimalware Scan Interface) is a Windows component that allows applications to integrate with installed antimalware products. Adversaries often attempt to bypass AMSI to execute malicious code without detection. This rule aims to identify such bypass attempts by flagging unusual process-AMSI.dll load combinations. The rule explicitly filters out common legitimate processes and directories that are known to load amsi.dll, such as explorer.exe, Sysmon64.exe, processes in Program Files, System32, SysWOW64, WinSxS, Windows Defender's MsMpEng.exe, and .NET framework related ngentask.exe processes.
Page 391 of 465