Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
37
32
20
8
6
Contributors
29
21
13
9
8
Categories
72
60
38
14
12
Platforms
114
5
5
4
Products / Services
66
40
21
15
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
2
IDS Protocols
4
Detects the usage of `findstr.exe` in combination with keywords like "Everyone" or "BUILTIN" to identify potentially misconfigured file or folder permissions. This activity is often seen during reconnaissance phases by adversaries looking for privilege escalation opportunities.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
This rule detects the execution of the `takeown.exe` utility with the `/f` (force) and `/r` (recursive) flags. Adversaries may use `takeown.exe` to gain ownership of files or directories, especially when combined with recursive operations, to bypass access controls and modify permissions. This action can be a precursor to further malicious activities such as modifying system files, installing persistence mechanisms, or exfiltrating data.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity can be indicative of an adversary trying to elevate privileges, establish persistence, or evade defenses by modifying critical system file permissions.
This rule detects the use of the 'dsacls.exe' utility to grant potentially over-permissive permissions on Active Directory objects. It specifically looks for the execution of 'dsacls.exe' with the '/G' flag, which is used to grant permissions, combined with common permission flags like 'GR' (Generic Read), 'GE' (Generic Execute), 'GW' (Generic Write), 'GA' (Generic All), 'WP' (Write Property), or 'WD' (Write DACL). This combination suggests an attempt to broaden access controls, which could be a legitimate administrative action or an adversary attempting to escalate privileges or maintain persistence.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Detects the use of `icacls.exe` with specific command-line arguments to deny access for everyone (represented by the SID *S-1-1-0*) to a file or directory. This technique is often used by adversaries to hide malicious files by making them inaccessible to users and potentially some security tools.
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Page 6 of 6