Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string
Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects a copy command or a copy utility execution to or from an Admin share or remote
CreateDump Process Dump
YARA-L
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Detects process access requests from hacktool processes based on their default image name
Detection well-known mimikatz command line arguments
Local Accounts Discovery
YARA-L
Local accounts, System Owner/User discovery using operating systems utilities
Detects the presence of the keywords lsass and .dmp in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process
Detects LSASS process access requests from a source process with the dump keyword in its image name
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Identifies the creation of local users via the net.exe command
PowerShell DownloadFile
YARA-L
Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation
PUA - Nimgrab Execution
YARA-L
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Page 396 of 465