Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
193
87
18
17
15
Contributors
54
46
42
41
30
Categories
143
142
77
60
47
Platforms
238
82
37
36
22
Products / Services
66
51
49
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
3
IDS Protocols
3
Detects the execution of AzureHound in PowerShell, a tool to gather data from Azure for BloodHound
Detects execution of a set of builtin commands often used in recon stages by different attack groups
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects execution of a set of builtin commands often used in recon stages by different attack groups
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Detects a set of suspicious network related commands often used in recon stages
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
Detect Active Directory LDAP queries that search for sensitive objects in the organization
This LDAP query cover BloodHound tool
This LDAP query cover BloodHound tool
Detects a set of suspicious network related commands often used in recon stages
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
'This query determines rare activity by a high-value account on a system or service. If any account with rare activity is found, the query retrieves related activity from that account on the same day and summarizes the information.'
The query finds attempts to list users or groups using Net commands.
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
Page 13 of 17