Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.
Detects potential DLL sideloading of "appverifUI.dll" when loaded by an 'appverif.exe' process from a non-standard or suspicious location. This rule aims to identify instances where an attacker might place a malicious 'appverifUI.dll' in a directory that 'appverif.exe' would load before its legitimate counterpart, leading to execution of the malicious DLL.
Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.
This rule detects PowerShell script blocks that modify the Windows Registry keys associated with Winlogon helper DLLs. Adversaries can modify these keys to load and execute malicious DLLs or executables when a user logs on, achieving persistence and potentially privilege escalation. The rule specifically looks for the string 'CurrentVersion\Winlogon' in conjunction with PowerShell cmdlets like 'Set-ItemProperty' or 'New-Item', indicating an attempt to alter Winlogon's configuration.
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects the creation or modification of a scheduled task using 'schtasks.exe' that is configured to run with 'NT AUTHORITY\SYSTEM' privileges. This can be an indicator of privilege escalation or persistence.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects modifications to specific Windows Registry keys under the `Wow6432Node\Microsoft\Windows NT\CurrentVersion` path, which are commonly used for autostart extensibility points (ASEPs). Specifically, it looks for changes to `Appinit_Dlls` and `Image File Execution Options` which can be abused for persistence or privilege escalation.
This rule detects modifications to the Windows Registry keys associated with Application Shimming. Adversaries may use application shims to establish persistence and/or elevate privileges by executing malicious content. The rule specifically looks for changes within the 'InstalledSDB' and 'Custom' AppCompatFlags registry paths, which are used to store information about installed shim databases.
This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Detects the loading of 'wbemcons.dll' by 'WmiPrvSE.exe', which is indicative of a WMI command line event consumer being used for persistence. This technique is often leveraged by adversaries to maintain access and execute code when specific WMI events occur.
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in the registry using dnscmd.exe, which can be used to execute code in the context of the DNS server (restart required). This technique can be used for privilege escalation or persistence.
Page 258 of 401