Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
17
15
10
3
1
Contributors
11
8
5
5
5
Categories
26
19
11
10
7
Platforms
35
9
3
3
Products / Services
25
11
6
6
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
This analytic detects when SQL Server loads DLLs to execute extended stored procedures. This is particularly important for security monitoring as it indicates the first-time use or version changes of potentially dangerous procedures like xp_cmdshell, sp_OACreate, and others. While this is a legitimate operation, adversaries may abuse these procedures for execution, discovery, or privilege escalation.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
This rule detects the execution of the 'xp_cmdshell' stored procedure within Microsoft SQL Server. 'xp_cmdshell' allows SQL Server to execute operating system commands directly, which is a common technique used by attackers for privilege escalation, lateral movement, and persistence within a compromised environment. The detection specifically looks for EventID 33205 in the application log, indicating a SQL Server event, and checks for the presence of 'object_name:xp_cmdshell' and 'statement:EXEC' in the event data, confirming the execution of this procedure.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
Page 3 of 3