Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,432
11,818
5,871
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.
Detects exploitation indicators of CVE-2022-42475, a heap-based buffer overflow vulnerability in FortiOS SSL-VPN's sslvpnd daemon. The rule specifically looks for the creation of known malicious files or configuration backups in specific directories, which are artifacts of successful exploitation.
Detects an exploitation attempt of CVE-2019-1388, a privilege escalation vulnerability. This involves the UAC consent dialogue (consent.exe) invoking an Internet Explorer process (iexplore.exe) with system-level privileges, indicated by 'System' or 'S-1-16-16384' integrity level and a command line containing ' http'.
Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.
Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability. This rule specifically looks for instances where a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) is spawned as a child process of the Microsoft Edge elevation service (elevation_service.exe) with SYSTEM integrity level, indicating a successful privilege escalation.
Detects User Account Control (UAC) bypass attempts leveraging NTFS reparse points and wusa.exe DLL hijacking, specifically targeting techniques similar to UACMe method 36. This rule identifies the creation of processes with elevated integrity levels (High or System) executing 'wusa.exe' with a specific command line pattern pointing to a temporary update.msu file, or 'dism.exe' as a parent process launching 'DismHost.exe' with a suspicious command line containing temporary paths.
Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.
This rule detects a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in `winsat.exe`. Specifically, it looks for the creation of a process with 'High' or 'System' integrity levels where the parent process image path ends with `\AppData\Local\Temp\system32\winsat.exe` and the parent command line contains `C:\Windows \system32\winsat.exe`. This pattern is indicative of UACMe method 52, which leverages a specially crafted path to trick `winsat.exe` into executing an arbitrary payload with elevated privileges.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands on the F5 BIG-IP device.
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule looks for specific HTTP POST requests containing 'NO_BINARY_CHECK=1' and 'input.path' in the URI query, ending with '.xsl', and resulting in a 200 or 302 HTTP status code. These patterns are indicative of an attempt to leverage the insecure XML parsing vulnerability.
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE, also known as BlueKeep. The detection specifically looks for failed RDP login attempts (EventID 4625) with a TargetUserName of 'AAAAAAA', which is a known signature of this scanner.
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675, also known as PrintNightmare. The rule specifically looks for EventID 808 with ErrorCode 0x45A or 0x7e, combined with keywords indicating a plug-in module load failure and common DLL names used in PrintNightmare Proof-of-Concept exploits.
Detects suspicious DLL loads by the Windows Print Spooler service from its backup driver folders. This behavior is indicative of exploitation attempts related to vulnerabilities like PrintNightmare (CVE-2021-1675, CVE-2021-34527) where an attacker can force the spooler service to load arbitrary DLLs, leading to privilege escalation or remote code execution.
This rule detects suspicious errors related to the Remote Desktop Protocol (RDP) that could indicate an attempt to exploit CVE-2019-0708, also known as BlueKeep. It specifically looks for Event IDs 56 or 50 generated by the 'TermDD' provider, which are associated with RDP session errors that can occur during exploitation attempts.
This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.
Detects the use of a Proof-of-Concept (PoC) tool designed to exploit the Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. The rule specifically looks for MsiInstaller Event ID 1033 with the data containing 'test pkg', which is indicative of the PoC's activity.
Page 152 of 159