Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Identifies the creation of local users via the net.exe command.
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detect use of PDQ Deploy remote admin tool
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Execution of plink to perform data exfiltration and tunneling
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
Detects audio capture via PowerShell Cmdlet.
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects email exfiltration via powershell cmdlets
Detects a suspicious or uncommon parent processes of PowerShell
Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of 3proxy, a tiny free proxy server
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
Page 457 of 465