Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen
Bypasses User Account Control using a fileless method
Detect remote login by Administrator user (depending on internal pattern).
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Detects using SettingSyncHost.exe to run hijacked binary
Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges
Detects the creation of a macro file for Outlook.
Detects file writes of WMI script event consumer
This query helps hunting for possible device code Phishing attempts
'This hunting query will alert on any Impossible travel activity in correlation with mailbox permission tampering followed by account being added to a PIM managed privileged group.
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
Ensure this impossible travel incident with increase of privileges is legitimate in your environment.'
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.
Winlogon Helper DLL
Sigma
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Detects potential COM object hijacking leveraging the COM Search Order
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Detects certificate creation with template allowing risk permission subject and risky EKU
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges
Detects process injection using the signed Windows tool Mavinject32.exe
Page 303 of 401