Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
109 detections
Filters
Last updated
All Time
Detection languages
97
5
3
2
1
Contributors
61
35
7
2
2
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
109
Products / Services
54
10
8
3
2
MITRE Techniques
67
65
50
28
20
CVEs
1
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detects suspicious PowerShell invocation command parameters
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Page 6 of 6