Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects a suspicious program execution in Outlook temp folder
Detects suspicious Plink tunnel port forwarding to a local port
Detects usage of a base64 encoded "IEX" cmdlet in a process command line
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Detects suspicious powershell invocations from interpreters or unusual programs
Detects usage of the Chisel tunneling tool via the commandline arguments
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection
Detects the execution of whoami that has been renamed to a different name to avoid detection
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
load malicious registered COM objects
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects dump of credentials in VeeamBackup dbo
Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)
Detects encoded base64 MZ header in the commandline
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects usage of the "systeminfo" command to retrieve information
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Detects a suspicious RDP session redirect using tscon.exe
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Page 451 of 465