Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Powershell Timestomp
Sigma
Adversaries may modify file time attributes to hide new or changes to existing files.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Adversaries may log user keystrokes to intercept credentials as the user types them.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
Page 160 of 160