Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.
The analytic detects the execution of msiexec.exe with the /y switch parameter, which enables the loading of DLLRegisterServer. This activity can indicate an attempt to register malicious DLLs, potentially leading to code execution or persistence on the system. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on logs containing process details and command-line executions. This activity is significant as it may indicate suspicious behavior, such as a user or process gathering detailed process information, which is uncommon for non-technical users. If confirmed malicious, this could allow an attacker to gain insights into running processes, aiding in further exploitation or lateral movement.
Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.
Detects the artifacts generally associated with the use of wmiexec.py
Net use commands for SMB/Windows admin shares based on asset entity group
Net use commands for SMB/Windows admin shares focused on specific user entity characteristics
Detects encoded powershell commands
Detects suspicious credential access commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the process mimikatz being issued from the command line.
Whoami Execution
YARA-L
Detects the execution of whoami, which is often used by attackers after exploitation to establish what credentials they are logged in under
Detects the clearing of event logs within the Windows Event Viewer.
A malicious file contacting a known Tor Exit Node.
Detect process launch events that correlate to Safe Browsing hash data and have low prevalence
IOC Hash Prevalence
YARA-L
Detect process/file events that match hashes found in our MISP instance and have low rolling max prevalence
IOC SHA256 Hash
YARA-L
Detect file/process events that match watchlisted hashes in MISP
Page 398 of 465