Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Detects failed logins with multiple invalid domain accounts from a single source system using the NTLM protocol.
Detects update to a scheduled task event that contain suspicious keywords.
Looks for multiple users that had their admin role removed by a single user within a certain period.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
'This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.'
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Detects changes to the default RDP port.
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
'Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to Microsoft Entra ID.
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.'
'This query look for Service Principal accounts that are no longer used where a user has added or updated credentials for them before logging in with the Service Principal.
Threat actors may look to re-activate dormant accounts and use them for access in the hope that changes to such dormant accounts may go un-noticed.'
Threat actors may look to re-activate dormant accounts and use them for access in the hope that changes to such dormant accounts may go un-noticed.'
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects the creation of a new service using powershell.
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects a when net.exe is called with a password in the command line
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Detects modification of autostart extensibility point (ASEP) in registry.
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Page 307 of 401