Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams.
The database might contain authentication tokens and other sensitive information about the logged in accounts.
The database might contain authentication tokens and other sensitive information about the logged in accounts.
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Detects when a memory process image does not match the disk image, indicative of process hollowing. This rule specifically looks for 'Image is replaced' events and filters out common legitimate applications that might exhibit similar behavior, such as applications in 'Program Files', 'Windows\System32\wbem\WMIADAP.exe', 'Windows\SysWOW64\wbem\WMIADAP.exe', Opera, and Edge.
Detects when one of the critical Windows Event Logs (PowerShell, Sysmon, Security, System) is cleared. This activity is often performed by adversaries to remove traces of their actions and evade detection. The rule specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider across these important channels.
Detects the creation of specific files within the SysAidServer Tomcat webapps directory, which are indicators associated with the Lace Tempest threat group (also known as FIN7). The rule looks for specific filenames and suffixes that have been observed in attacks involving PowerShell scripts by this group.
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects the execution of the 'msxsl.exe' utility with an 'http' keyword in the command line, indicating a potential attempt to execute XSL files from a remote source. This technique can be used by adversaries to bypass application control and execute malicious scripts.
This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.
This rule detects the execution of `find.exe` or `findstr.exe` on Windows systems when used to search for keywords commonly associated with security tools. Attackers often use these utilities to discover installed security software by piping the output of other reconnaissance commands (like `tasklist` or `whoami`) through `findstr` to filter for specific terms. The rule specifically looks for command-line arguments containing keywords such as "avira", "cb", "cylance", "defender", "kaspersky", "kes", "mc", "sec", "sentinel", "symantec", and "virus", including variations with double quotes.
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.
Detects process access requests from hacktool processes based on their default image name
Detects suspicious parent process for cmd.exe
Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.
Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Page 436 of 465