Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
201 detections
Filters
Last updated
All Time
Detection languages
113
61
11
8
2
Contributors
57
40
32
13
8
Categories
94
86
76
37
36
Platforms
198
5
3
2
1
Products / Services
70
51
41
19
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
IDS Classtypes
1
1
IDS Protocols
1
1
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects powershell scripts that import modules from suspicious directories
Detects usage of the Quarks PwDump tool via commandline arguments
Detects powershell scripts that import modules from suspicious directories
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Files with well-known filenames (sensitive files with credential data) copying
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Shadow Copies storage symbolic link creation using operating systems utilities
Detection well-known mimikatz command line arguments
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Shadow Copies creation using operating systems utilities, possible credential access
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Page 10 of 10