Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects usage of Gpg4win to encrypt files
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Detects suspicious powershell command line parameters used in Empire
Detects the use of KrbRelay, a Kerberos relaying tool
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detects usage of the Sharp Chisel via the commandline arguments
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Use of hostname to get information
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects password change for the computer's domain account or host principal via "ksetup.exe"
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects process dump via legitimate sqldumper.exe binary
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects when an admin share is mounted using net.exe
Detects when a share is mounted using the "net.exe" utility
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects nltest commands that can be used for information discovery
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Page 450 of 465