Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
63
27
11
4
4
Contributors
17
17
13
12
6
Categories
40
25
25
22
17
Platforms
95
39
22
1
1
Products / Services
21
16
14
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects the creation of WMI event subscriptions, which can be used as a persistence mechanism by adversaries. This rule specifically looks for Sysmon Event IDs 19 (WmiEventFilter activity), 20 (WmiEventConsumer activity), and 21 (WmiEventConsumerToFilter activity), indicating the creation or modification of WMI event filters, consumers, or their binding.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code when Outlook is launched.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.
This rule detects modifications to the 'DelegateExecute' registry value within the 'HKCU\Software\Classes\Folder\shell\open\command' key. This specific registry modification is a known technique used for COM hijacking, often leveraged in UAC bypasses, such as those involving sdclt.exe. An attacker can modify this key to execute an arbitrary program when a user attempts to open a folder, leading to persistence or privilege escalation.
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
Detects the creation of a macro file for Outlook.
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the creation of a macro file for Outlook.
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Detects scenarios where an attacker changed the IFEO settings related to sethc.
Detects modifications to the default program associated with .txt files, specifically looking for changes to the 'open' command or 'UserChoice' registry keys. This can be indicative of an adversary attempting to establish persistence or execute malicious code when a user opens a text file.
Detects scenarios where an attacker modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker changes permissions on the AdminSDHolder container to establish persistence.
Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
WMI registration
Sigma
Detects scenarios where an attacker createsan instance of a WMI class using tools like WMImplant or PowerLurk.
Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Page 4 of 6