Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
Detects scenarios where an attacker attempts to modify the type of symbolic link than can be created.
Detects scenarios where an attacker resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
Detects scenarios where a suspicious group membership is changed.
Detects the PerfhLoader persistence technique used by the Lazarus Group, which involves modifying the 'SessionEnv' service to start automatically and either adding sensitive privileges or dropping a malicious DLL for phantom loading. This rule correlates events across process launches (sc.exe modifying SessionEnv service), registry modifications (adding privileges to SessionEnv service), and file creations (dropping a specific DLL for phantom loading).
Schedule vb script From Appdata
Detects scenarios where an attacker enables a disabled builtin account via command line.
WMI registration
Sigma
Detects scenarios where an attacker createsan instance of a WMI class using tools like WMImplant or PowerLurk.
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects scenarios where an attacker creates a scheduled task via commmand line.
Detects scenarios where an attacker attempts to enable the Image File Execution Options (IFEO) debugger for sethc.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where an attacker abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.
Detects scenarios where an attacker updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.
register jar in run key
Detects scenarios where an attacker grants new privileges on a database level
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
Detects scenarios where an attacker set an account with DES Kerberos encryption to perform ticket brutforce.
Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
Detects the DLL sideloading of `jli.dll` by `java.exe` from common malware staging directories. This technique was observed being used by ReadNimeLoader as part of a BlackBasta-associated campaign.
powershell with enco parameter launched by winword / excel / powerpoint
Page 280 of 401