Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
13
1
1
1
Contributors
8
5
1
1
1
Categories
10
4
1
1
1
Platforms
15
1
1
Products / Services
3
3
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects potential DLL hijacking attempts targeting Terminal Services (RDP) by looking for the string "termsrv.dll" within TCP traffic destined for port 3389 (RDP). This could indicate an attacker attempting to load a malicious DLL in place of the legitimate termsrv.dll to maintain persistence or execute arbitrary code.
Detects PowerShell scripts set ACL to of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects PowerShell execution to set the ACL of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects PowerShell scripts set ACL to of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects PowerShell execution to set the ACL of a file or a folder
Detects PowerShell execution to set the ACL of a file or a folder
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
