Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
81
61
8
7
5
Contributors
29
26
22
20
14
Categories
51
33
31
25
23
Platforms
149
16
12
5
2
Products / Services
51
39
14
13
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
2
1
IDS Protocols
3
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
This rule detects the execution of PowerShell scripts that directly call a wide range of Windows API (WinAPI) functions. Adversaries often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell cmdlets or .NET methods. The rule specifically looks for a comprehensive list of sensitive WinAPI functions within the script block text, which can indicate various malicious activities such as process injection, privilege escalation, credential access, and memory manipulation. This rule is primarily intended for threat hunting to identify unusual and potentially malicious PowerShell script behavior.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the use of specific Windows API (WinAPI) libraries within PowerShell scripts. Attackers often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell function calls. The rule specifically looks for the presence of 'Advapi32.dll', 'kernel32.dll', 'KernelBase.dll', 'ntdll.dll', 'secur32.dll', and 'user32.dll' within the PowerShell script block text. This can indicate attempts to perform low-level system operations or interact with the operating system in a way that might evade higher-level monitoring.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Detects suspicious mshta process execution patterns
Page 9 of 9