Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands
Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass
Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.
Detects potentially suspicious file downloads directly from IP addresses using Wget.exe
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Detects suspicious processes including shells spawnd from WinRM host process
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
Detects the use of Windows Credential Editor (WCE)
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt
Detects that a powershell code is written to the registry as a service.
Detects potential persistence activity via outlook home page.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
Files with well-known filenames (sensitive files with credential data) copying
Page 460 of 465