Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects attempts to bypass User Account Control (UAC) using the Microsoft Connection Manager Profile Installer (CMSTP) by abusing specific autoelevate-capable COM objects. The detection logic looks for processes where 'DllHost.exe' is the parent process, the parent command line contains specific COM Process IDs associated with CMSTP or related components, and the process is running with 'High' or 'System' integrity levels. This technique is often used by adversaries to elevate privileges without user interaction.
Detects the execution of 'wsreset.exe' with elevated privileges (High or System integrity levels). This behavior is indicative of a User Account Control (UAC) bypass attempt, as 'wsreset.exe' is a legitimate Windows utility that can be abused to elevate privileges without a UAC prompt.
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading. This technique can be used for defense evasion by masquerading malicious code as legitimate system components.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the loading of specific malicious DLLs (ffmpeg.dll, d3dcompiler_47.dll, and an ICONIC Stealer payload) that were identified as compromised and used in attacks involving the 3CXDesktopApp. This rule uses SHA256, SHA1, and MD5 hashes to identify the malicious DLLs.
Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.
Detects potential SquiblyTwo attack technique where WMIC is used to execute remote XSL files. This rule specifically looks for WMIC execution with command-line arguments indicating a format specifier and an HTTP URL, combined with checks for the original WMIC executable name or known WMIC ImpHashes, even if the binary is renamed.
Detects the execution of the GMER tool, a rootkit detector and remover, based on its executable name and known file hashes. This tool can be used by adversaries to impair defenses by identifying and disabling security software or hidden processes.
Detects the execution of 'nimgrab.exe', a tool often bundled with the Nim programming framework and used for downloading files. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
Detects potential RDP Session Hijacking activity on Windows systems
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects the use of NPS, a port forwarding and intranet penetration proxy server
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine
Page 434 of 465