Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
Detects PowerShell script execution from Alternate Data Stream (ADS)
Detects suspicious PowerShell invocation with a parameter substring
Attackers can use print.exe for remote file copy
Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
Uses the .NET InstallUtil.exe application in order to execute image without log
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.
Detects creation of WMI event subscription persistence method
Yara rule that detects Bam2021 ransomware.
Yara rule that detects Pay2Key ransomware.
Page 465 of 465