Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.
Backup Files Deleted
Sigma
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
Detects the creation of new files with the ".evtx" extension in non-common or non-standard locations. This could indicate tampering with default EVTX locations to evade security controls or exfiltration of event logs to search for sensitive information. Note that backup software and legitimate administrators might perform similar actions during troubleshooting.
This rule detects the execution of rundll32.exe with a command line that does not specify a common DLL extension (.cpl, .dll, .inf). Adversaries often use rundll32.exe to execute malicious code, and by using uncommon or no extensions, they attempt to evade detection mechanisms that might look for standard rundll32.exe usage. The rule filters out known legitimate uses of rundll32.exe, such as those involving common extensions, local server invocations, MSIExec processes, and specific Microsoft EdgeUpdate processes.
Detects tampering with the "Enabled" registry key to disable Windows event logging for a specific event channel. This activity is often performed by adversaries to evade detection by security tools and analysts.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
This rule detects the creation, modification, copying, or moving of Windows shortcut (.lnk) files into sensitive user directories such as Desktop, Documents, and Start Menu folders. Adversaries often use .lnk files for persistence, execution, or to deliver malicious payloads, especially when placed in locations that are frequently accessed or automatically executed by the system or user.
This rule detects attempts to change the 'Altitude' registry value for the Sysmon driver instance. Modifying this value can prevent Sysmon from loading correctly at boot if the new altitude conflicts with other registered services, effectively disabling or impairing its monitoring capabilities. This technique is often used by adversaries to evade detection.
This rule detects DNS queries to domains that have been created within the last 30 days. This behavior can be indicative of newly registered malicious domains used for command and control, phishing, or other adversarial activities. The rule correlates DNS query events with WHOIS data to identify the domain creation time.
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
This rule detects suspicious connections to the ADFS database via named pipes. It specifically looks for processes connecting to the `\\MICROSOFT##WID\tsql\query` named pipe on ADFS servers, excluding legitimate ADFS-related processes such as `Microsoft.Identity.Health.Adfs.PshSurrogate.exe`, `Microsoft.IdentityServer.ServiceHost.exe`, `AzureADConnect.exe`, `Microsoft.Tri.Sensor.exe`, `wsmprovhost.exe`, `mmc.exe`, `sqlservr.exe`, and `sqlwriter.exe`. Such connections from unauthorized processes may indicate an attempt to access ADFS for malicious purposes.
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
This rule detects file modifications to ASPX and ASHX files within the root of the 'App_Extensions' directory by the 'ScreenConnect.Service.exe' process. This activity is indicative of exploitation of CVE-2024-1708, a ZipSlip vulnerability in ConnectWise ScreenConnect versions prior to 23.9.8, which allows for path traversal and arbitrary file write.
This rule detects the creation of specific configuration files (`.conf`) in the `AppData\Roaming` directory, which have been observed in the wild to be associated with Remote Access Trojans (RATs) such as VenomRAT, AsyncRAT, and Lumma Stealer. The rule looks for files ending with `datalogs.conf`, `hvnc.conf`, or `dcrat.conf` within subdirectories like `mydata`, `datalogs`, `hvnc`, or `dcrat` under `AppData\Roaming`.
Detects file modifications to the temporary XML user database file in the ScreenConnect server. This activity can indicate local user modification, potentially as part of the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8. It may also be observed during legitimate modifications to local users or permissions within ScreenConnect.
Detects the execution of the Qakbot uninstaller file, identified by its filename or specific file hashes, as mentioned in the USAO-CDCA document regarding the disruption of the Qakbot malware and botnet. This rule helps identify systems where the Qakbot uninstaller has been run, which could indicate remediation efforts or system compromise.
Page 432 of 465