Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
Detects scenarios where an attacker remotely creates a scheduled task on multiple hosts over named pipes to execute commands or elevate privileges.
Help to detect scenarios where an attacker exploit the Mimispool print driver to escalate privileges.
Detects scenarios where an attacker grants new rights to an account in order to escalate privileges
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
Detects scenarios where an attacker set an account with reversible encryption to facilitate brutforce or cracking operations.
Detects scenarios where an account password is set to never expire.
Detects scenarios where an attacker creates a user account that fakes a computer account.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where a new member is added to a sensitive group related to Exchange server
Detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects if an attacker logs on using the serial console.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker adds a SPN to an account in order to perform different type of abuse (Kerberoast, delegation abuse, ...)
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Page 281 of 401