Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Finger.EXE Execution
YARA-L
Detects execution of the finger.exe utility. Finger.EXE or \"TCPIP Finger Command\" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of finger.exe can be considered suspicious and worth investigating.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable. Procdump dump of lsass using minidump or memory dump options. Covers atomic tests 1 and 8
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.
PowerShell Web Download
YARA-L
Detects suspicious ways to download files or content using PowerShell
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Detects the execution of certutil with certain flags that allow the utility to download files
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
IOC Domain C2
YARA-L
Detect DNS events that indicate communication to a C2 domain in MISP
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Net use commands for SMB/Windows admin shares focused on UDM enriched user fields
Detects process launches from processes related to ntds against key servers
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Alert on known Hash querying a known hostname with VT Relationships
Page 395 of 465