Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
100 detections
Filters
Last updated
All Time
Detection languages
46
33
12
6
1
Contributors
23
18
12
9
8
Categories
48
46
18
15
14
Platforms
80
8
7
5
4
Products / Services
23
20
13
12
10
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
3
3
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the execution of `powershell.exe` with the `Get-LocalUser` commandlet, which is used to query local user accounts. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is significant because adversaries and Red Teams may use it to enumerate local users for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to identify potential targets for further exploitation or privilege escalation within the environment.
Detects PowerShell command execution that combines typical Active Directory or system reconnaissance commands with potential persistence mechanisms, which is a common indicator of post-exploitation activity.
This rule detects the execution of processes that contain the command line argument 'Found sid:', which is commonly associated with security identifier (SID) enumeration or lookup tools/scripts, such as those used by security researchers or attackers during reconnaissance.
Detects local validation of a phished password via dscl -authonly immediately followed by sudo -S -v in a short time window, matching AmnesiaStealer's technique for confirming captured credentials are valid before reuse.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
This rule detects account and credential enumeration activities using the macOS 'dscl' (Directory Service Command Line) utility. It specifically monitors for 'dscl' commands ('-list /Users', '-read', or '-authonly') being invoked by unsigned shell scripts (sh, bash, zsh) or scripts running from suspicious locations like '/tmp/', '/private/tmp/', '/private/var/folders/', or '/Downloads/'. The rule effectively identifies potential reconnaissance or credential harvesting attempts often associated with malicious macOS 'clickfix' campaigns.
Detects local Administrators group enumeration via net.exe or net1.exe within 10 minutes of a PsExec session on the same device. This behavior is indicative of post-compromise privilege or account discovery following remote service execution.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects the remote_logon C2 command token correlated with an absence of a matching auth event, indicating passive logon-session enumeration.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects execution of the macOS 'dscl' utility using the '-authonly' flag. This command is used to authenticate a user against a directory service without creating a session, which can be indicative of brute-force attempts or credential validation by unauthorized processes.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects enumeration of local system accounts on MacOS systems.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.
Detects various privilege escalation and reconnaissance techniques commonly associated with the 'Operation Poisson' campaign, including UAC bypass attempts, local administrator group enumeration, and administrative privilege verification triggered by script interpreters.
Detects the execution of 'net.exe' or 'net1.exe' to create a new user account with a prefix indicative of potential persistence or backdooring (rage_master_). The rule further filters for executions originating from suspicious directories such as \Temp\, \Users\Public\, or \ProgramData\, which are common staging areas for malicious binaries.
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Page 1 of 5