Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects scenarios where an attacker changed the IFEO settings related to sethc.
Detects scenarios where an attacker loads a malicious SSP (Security Support Provider) into the LSA process. Note that this rule will not work with "in memory" SSP injection (Mimikatz) as no event will be triggered.
Detects scenarios where an attacker attempts to request a proxiable ticket. This action may trigger while attempting to identify a vulnerable target or using some offsensive Kerberos tools like Kerbrute, Impacket...
Detects modifications to the default program associated with .txt files, specifically looking for changes to the 'open' command or 'UserChoice' registry keys. This can be indicative of an adversary attempting to establish persistence or execute malicious code when a user opens a text file.
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Detects scenarios where an attacker would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.
Detects scenarios where an attacker abuse RPC, NTLM relay and others components to escalate privileges.
Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects scenarios where an attacker modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.
The analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. It leverages Azure Audit events, specifically the "Create or Update an Azure Automation webhook" operation, to identify this activity. This behavior is significant because Webhooks can trigger Automation Runbooks via unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed malicious, an attacker could use this to execute code, create users, or maintain persistence within the environment, potentially leading to unauthorized access and control over Azure resources.
Detects TTPs associated with a Lazarus subgroup using the SessionEnv service for persistence and privilege escalation. This involves phantom DLL loading, service auto-start configuration, and registry modification for elevated privileges.
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker set an account with password not required to perform privilege escalation attack.
Detects scenarios where an attacker removes security protection from a sensitive account to escalate privileges
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller.
exe launched by dll with ReflectiveLoader export function
Detects scenarios where an attacker creates a privileged task to establish persistence.
Detects scenarios where an attacker enables a disabled builtin account.
Page 278 of 401