Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context
Detects the creation of binaries in the WinSxS folder by non-system processes
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Detects processes loading modules related to PCRE.NET package
Detects any GAC DLL being loaded by an Office Product
Detects a remote DLL load event via "rundll32.exe".
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.
The data may also be sent to an alternate network location from the main command and control server.
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Page 449 of 465