Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects a copy command or a copy utility execution to or from an Admin share or remote
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
Detects when a share is mounted using the "net.exe" utility
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network and loading it for a DCOM InternetExplorer DLL Hijack scenario.
Detecting use PsExec via Pipe Creation/Access to pipes
Detects a when net.exe is called with a password in the command line
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Detects default CSExec pipe creation
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects when an admin share is mounted using net.exe
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.
Detects the use of smbexec.py tool by detecting a specific service installation
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Page 20 of 25