Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects when an attacker attempts to disable or modify Sysmon's configuration to evade detection. This rule specifically looks for Sysmon's state changing to 'Stopped' or a 'Sysmon config state changed' event occurring when Sysmon was not already in a 'Started' state.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects when the 'outlvba.dll' (Microsoft VBA for Outlook Addin) is loaded by the 'outlook.exe' process. This activity can indicate the use of VBA macros within Outlook, which can be leveraged for persistence or execution by adversaries.
This rule detects the creation of named pipes with specific naming conventions commonly used by Cobalt Strike. Cobalt Strike is a legitimate penetration testing tool that is frequently misused by threat actors for post-exploitation activities. The rule looks for pipe names containing "\MSSE-" and "-server", or starting with "\postex_", "\status_", "\msagent_", "\mojo_", "\interprocess_", "\samr_", "\netlogon_", "\srvsvc_", "\lsarpc_", or "\wkssvc_". These patterns are indicative of Cobalt Strike's beacon communication or other internal operations.
Detects suspicious child processes spawned by "aspnet_compiler.exe". This often indicates an adversary is abusing the legitimate `aspnet_compiler.exe` utility for proxy execution, potentially to bypass application controls or execute malicious code from unexpected locations. The rule specifically looks for common executables like `calc.exe` or `notepad.exe` and processes launched from suspicious temporary or user-specific directories.
This rule detects the creation of child processes by 'cmstp.exe', the Microsoft Connection Manager Profile Installer. Adversaries often abuse cmstp.exe to proxy execution of malicious code, bypass User Account Control (UAC), or evade application control defenses by loading and executing DLLs or COM scriptlets. This detection specifically looks for any process that has 'cmstp.exe' as its direct parent.
This rule detects the execution of 'ScriptRunner.exe' with the '-appvscript' command-line argument. 'ScriptRunner.exe' is a legitimate Windows binary that can be abused to proxy execution, potentially bypassing whitelisting or other security controls. This specific command-line argument indicates its use in the context of App-V scripting, which can be leveraged for malicious purposes.
Detects an executable in a user's directory that is spawned by a Microsoft Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, Equation Editor). This behavior is often associated with malicious documents attempting to execute payloads.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects child processes of 'provlaunch.exe' which might indicate potential abuse to proxy execution. Adversaries may use 'provlaunch.exe', a legitimate Windows binary, to execute arbitrary commands or binaries, bypassing security controls or masquerading malicious activity.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
This rule detects the registration of new ODBC (Open Database Connectivity) drivers by monitoring modifications to specific registry keys. It specifically looks for changes within the `\SOFTWARE\ODBC\ODBCINST.INI\` path where the `TargetObject` ends with `\Driver`. The rule includes filters to exclude common legitimate ODBC driver registrations for SQL Server, Microsoft Access, and Microsoft Excel to reduce false positives.
This rule detects when the Sysmon configuration is changed. This event (EventID 16) is generated by Sysmon itself when its configuration is updated, which could be a legitimate administrative action to reconfigure Sysmon or an attempt by an adversary to manipulate its monitoring capabilities to evade detection.
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.
This rule detects the execution of "VMwareToolBoxCmd.exe" with specific command-line arguments ("script" and "set") that indicate an attempt to configure a script to run when a virtual machine changes state. This technique can be used by adversaries to establish persistence within a virtualized environment.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Page 445 of 465