Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Use of the commandline to shutdown or reboot windows
Detects the rare use of the command line tool shutdown to logoff a user
Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)
Detect attacker collecting audio via SoundRecorder application.
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Detects the deletion of backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.
Detects possible execution via LNK file accessed on a WebDAV server.
Page 459 of 465