Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects the execution of SecurityXploded Tools
Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
Detects SILENTTRINITY stager use via PE metadata
Detects execution of the IEExec utility to download and execute files
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Detects suspicious mshta process execution patterns
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Detects RDP session hijacking by using MSTSC shadowing
Detects the stopping of a Windows service via the "net" utility.
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Page 456 of 465