Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Detects block events for files that are disallowed by code integrity for protected processes
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Detects suspicious application installed by looking at the added shortcut to the app resolver cache
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Page 83 of 83