Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Detects command line parameters used by Hydra password guessing hack tool
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects well-known credential dumping tools execution via specific named pipe creation
Detects PAExec default named pipe
Detects usage of Gpg4win to decrypt files
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects command line parameters or strings often used by crypto miners
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Detects default CSExec service filename which indicates CSExec service installation and execution
Detects suspicious file type dropped by an Exchange component in IIS
Detects a dump file written by QuarksPwDump password dumper
Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".
Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.
Detects processes creating temp files related to PCRE.NET package
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Page 448 of 465