Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process.
This way we are also able to catch cases in which the attacker has renamed the procdump executable.
This way we are also able to catch cases in which the attacker has renamed the procdump executable.
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects suspicious process run from unusual locations
Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects a CodePage modification using the "mode.com" utility to Russian language.
This behavior has been used by threat actors behind Dharma ransomware.
This behavior has been used by threat actors behind Dharma ransomware.
Procdump Execution
Sigma
Detects usage of the SysInternals Procdump utility
Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow
Detects a CodePage modification using the "mode.com" utility.
This behavior has been used by threat actors behind Dharma ransomware.
This behavior has been used by threat actors behind Dharma ransomware.
Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.
Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process.
This way we are also able to catch cases in which the attacker has renamed the procdump executable.
This way we are also able to catch cases in which the attacker has renamed the procdump executable.
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects a potentially suspicious execution from an uncommon folder.
Page 37 of 40