Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects when a user downloads a file by using CertOC.exe
Detects possible payload obfuscation via the commandline
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Detects usage of the "type" command to download/upload data from WebDAV server
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Well-known DNS Exfiltration tools execution
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Attackers may leverage fsutil to enumerated connected drives.
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Detects potential process patterns related to Cobalt Strike beacon activity
Detects suspicious process patterns found in logs when CrackMapExec is used
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects the execution of the PurpleSharp adversary simulation tool
Detects usage of the Quarks PwDump tool via commandline arguments
Page 455 of 465