Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Adversaries may log user keystrokes to intercept credentials as the user types them.
Attackers can use print.exe for remote file copy
Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs
Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
Page 45 of 45