Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects a single user failing to authenticate to multiple users using explicit credentials.
DLL Load via LSASS
Sigma
Detects a method to load DLL via LSASS process using an undocumented Registry key
Detects the use of SharpUp, a tool for local privilege escalation
Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.
Detects the creation of a new service using powershell.
Detects PowerShell writing startup shortcuts.
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Detects scenarios where one can control another users or computers account without having to use their credentials.
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
Detects the creation of a new service using the "sc.exe" utility.
Detects persistence registry keys for Recycle Bin
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Page 302 of 401