Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
445 detections
Filters
Last updated
All Time
Detection languages
200
123
25
25
20
Contributors
96
68
59
44
34
Categories
266
237
104
47
39
Platforms
313
149
52
51
12
Products / Services
95
72
36
26
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
15
14
13
11
8
IDS Classtypes
6
4
3
2
2
IDS Protocols
15
3
2
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Page 22 of 22