Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of command-line tools associated with Kerberoasting and Kerberos ticket manipulation techniques, such as requesting TGS tickets or targeting specific user accounts for ticket extraction.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Detects the use of icacls.exe or cacls.exe to modify access control lists (ACLs) on sensitive Windows system directories and files. The rule specifically alerts when these commands are executed by non-Microsoft signed processes, which is a common indicator of unauthorized privilege escalation or persistence mechanisms.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
This rule detects common Kerberoasting activities by monitoring for the execution of 'Rubeus' or 'GetUserSPNs' (often associated with Impacket) in process command lines. These tools are commonly used by attackers to request service tickets for service accounts, which can then be cracked offline to recover passwords.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
This rule detects potentially malicious invocations of rundll32.exe that utilize scripting protocols (javascript:, vbscript:) or suspicious execution parameters (ShellExec_RunDLL, LaunchApplication), as well as rundll32.exe executing from non-standard or user-writable directories (e.g., AppData, Temp). The rule further filters out trusted Microsoft-signed binaries to reduce noise while highlighting potential proxy execution attempts.
Detects high-frequency non-standard process executions involving WMI queries that specifically target virtual environment artifacts (e.g., VMware, VirtualBox, VBoxService, QEMU). This behavior is characteristic of sandbox or virtualization evasion, where malware attempts to identify if it is running in a virtualized or analysis environment to potentially alter its behavior.
This rule detects common Kerberoasting activities by monitoring for the execution of 'Rubeus' or 'GetUserSPNs' (often associated with Impacket) in process command lines. These tools are commonly used by attackers to request service tickets for service accounts, which can then be cracked offline to recover passwords.
This rule detects the use of 'wmic.exe' with the '/format' switch to execute XSL files, or the direct execution of 'msxsl.exe'. These methods are common techniques used by adversaries to bypass security controls by executing arbitrary scripts embedded within XSL files, often fetched from remote locations or local paths.
Detects the creation of scheduled tasks using schtasks.exe where the command originates from or references the C:\ProgramData\ directory. This pattern is consistent with the SystemBC (Coroxy) malware's persistence mechanism, where a randomly named executable is staged in ProgramData and configured for execution via Task Scheduler.
Detects execution of the Microsoft InstallUtil.exe utility with suspicious command-line arguments (logging suppressed to file and console) where the binary is unsigned. This is a common technique used by adversaries to proxy execution of arbitrary .NET code while attempting to avoid detection and maintain stealth.
Detects the execution of known Active Directory discovery tools, specifically 'adfind.exe' or 'dsquery.exe' with arguments targeting user or group enumeration. These tools are commonly used by adversaries during the reconnaissance phase to map domain structure.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup of the Active Directory database (NTDS.dit) and registry hives to a local SMB loopback share. This behavior is a technique used by Akira ransomware actors to bypass file locking mechanisms and exfiltrate sensitive credential material.
Detects the remote execution of credential dumping activities via the lsassy tool. The rule identifies rundll32.exe being used to load comsvcs.dll for the purpose of creating a full MiniDump of the LSASS process memory. It specifically monitors for these actions occurring within common remote administrative execution contexts, such as SMB services, WMI, scheduled tasks, and DCOM, with output files staged in the Windows\Temp directory.
Page 406 of 976