Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the suspicious execution of 'explorer.exe' with the '/NOUACCHECK' command-line flag. This flag can be used to bypass User Account Control (UAC) checks for all subprocesses launched by the newly started explorer.exe instance, potentially allowing an attacker to elevate privileges or execute malicious code without user interaction. The rule filters out legitimate instances where 'explorer.exe' is launched by the Windows Task Scheduler service ('svchost.exe -k netsvcs -p -s Schedule').
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable.
Detects the execution of 'register-cimprovider.exe' with command-line arguments indicating an attempt to register a DLL. This technique can be used by adversaries to achieve persistence, privilege escalation, or defense evasion by loading malicious DLLs through a legitimate Windows binary.
This rule detects the execution of a renamed 'dctask64.exe' binary. 'dctask64.exe' is a legitimate, signed executable by ZOHO Corporation, part of ManageEngine Endpoint Central. Adversaries can abuse this binary for malicious purposes such as DLL injection, arbitrary command execution, and process execution. The detection logic specifically looks for process creation events where the image hash matches known hashes of 'dctask64.exe' but the filename is not 'dctask64.exe', indicating a potential masquerading attempt.
Detects suspicious modifications to a Windows service's Discretionary Access Control List (DACL) using 'sc.exe' to deny access to critical trustees. This technique can be used by adversaries to hide services, make them unstoppable, or achieve persistence and privilege escalation by preventing legitimate users or administrators from managing the service.
Detects the creation of a scheduled task where the task name (`/TN`) is a GUID-like string. This behavior is often observed in malware or advanced persistent threats to maintain persistence or execute malicious code, as using GUIDs can help obfuscate the task's purpose or make it less conspicuous among legitimate tasks.
Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Detects changes to the default RDP port (3389) in the Windows Registry. Adversaries may modify the RDP port to maintain persistence or evade detection, as this change can allow them to continue using RDP for remote access on a non-standard port.
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
Detects potential DLL sideloading of 'iviewers.dll' (OLE/COM Object Interface Viewer) when it is loaded from a location other than the legitimate Windows Kits directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "SolidPDFCreator.dll" when loaded by an executable other than "SolidPDFCreator.exe" or from an unexpected directory. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of 'wwlib.dll' by identifying instances where 'wwlib.dll' is loaded by an executable that is NOT a legitimate Microsoft Office Word process. This rule specifically filters out loads from standard Microsoft Office installation paths for 'winword.exe' to reduce false positives.
This rule detects when the 'notepad.exe' process initiates a network connection. This behavior is highly unusual for Notepad and can indicate malicious activity such as process injection where a beacon or other malicious code is running within the legitimate Notepad process to establish command and control. Notepad typically only initiates network communication when printing documents, which is filtered out by this rule.
This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.
Detects the modification of an existing service's configuration (binpath or failure command) using 'sc.exe' or 'reg.exe' to execute an arbitrary payload. This is a common method for establishing persistence or escalating privileges by ensuring a malicious executable runs when the service starts or fails.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee using 'sc.exe sdset'. This technique can be used by adversaries for privilege escalation or persistence by overriding existing access restrictions on Windows services.
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.
Page 259 of 401