Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detect the use of net use for SMB/Windows admin shares
Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4
Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects system enumeration events as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the use of powershell to enumerate successful logins on a specific host
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
This rule detects the launch of web browsers (both Chromium-based and Firefox) with command-line arguments that enable remote debugging. This functionality, while legitimate for developers, can be abused by attackers to inject malicious code, steal credentials, or perform browser session hijacking. The rule specifically looks for '--remote-debugging-' in Chromium-based browsers and '-start-debugger-server' in Firefox.
Detects Octopus Scanner Malware.
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects the creation of the default output filename used by the wmiexec tool
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Page 397 of 465