Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
193
87
18
17
15
Contributors
54
46
42
41
30
Categories
143
142
77
60
47
Platforms
238
82
37
36
22
Products / Services
66
51
49
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
3
IDS Protocols
3
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
Detects the usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dll" DLL. This DLL is often used by attackers to perform Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) are not installed or administrative privileges are not available.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects the execution of SharpLDAPmonitor, a tool used to monitor the creation, deletion, and changes to LDAP objects. This rule triggers on either the image name 'SharpLDAPmonitor.exe' or its original filename, combined with command-line arguments indicating user, password, and domain controller IP, which are typical for LDAP monitoring activities.
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet to enumerate local group memberships, specifically looking for common administrative or privileged groups. This activity is often performed by attackers during the discovery phase to identify potential privilege escalation paths or valuable targets.
Detects the execution of the reconnaissance tool Seatbelt. This rule identifies Seatbelt activity based on its executable name, original file name, description, and specific command-line arguments used for various discovery tasks, including DpapiMasterKeys, InterestingProcesses, InterestingFiles, CertificateThumbprints, Chromium data, CloudCredentials, CredEnum, CredGuard, FirefoxHistory, and ProcessCreationEvents. It also covers group-based commands like 'misc', 'remote', 'chromium', 'slack', 'system', 'user', and 'all', as well as output to a file.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Page 17 of 17