Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Running Chrome VPN Extensions via the Registry install 2 vpn extension
Detects registry modifications that disable Privacy Settings Experience
Detect set EnableFirewall to 0 to disable the Windows firewall
Detect set DisallowRun to 1 to prevent user running specific computer program
Hides the file extension through modification of the registry
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
PktMon.EXE Execution
Sigma
Detects execution of PktMon, a tool that captures network packets.
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Page 462 of 465