Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file
Detects command line parameters used by Bloodhound and Sharphound hack tools
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Commandline to launch powershell with a base64 payload
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Detection of unusual child processes by different system processes
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects suspicious process patterns used in NTDS.DIT exfiltration
Shadow Copies creation using operating systems utilities, possible credential access
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Page 464 of 465