Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects powershell scripts that import modules from suspicious directories
Detects PowerShell calling a credential prompt
Detects Commandlet names from ShellIntel exploitation scripts.
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Detects suspicious PowerShell download command
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
Detects the use of PowerShell to identify the current logged user.
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Get the processes that are running on the local computer.
Detects suspicious PowerShell invocation command parameters
Detects PowerShell scripts that contains reference to keystroke capturing functions
Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence
Detects execution of a PowerShell script that contains calls to the "Veeam.Backup" class, in order to dump stored credentials.
Page 158 of 160