Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"
Detects suspicious use of XORDump process memory dumping utility
Detects uses of the rdrleakdiag.exe LOLOBIN utility to dump process memory
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects a potentially suspicious execution from an uncommon folder.
Detects a code page switch in command line or batch scripts to a rare language
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Procdump Execution
Sigma
Detects usage of the SysInternals Procdump utility
Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Page 35 of 40