Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
'Identifies any Azure VM Run Command operations and links these operations with
MDE host logging. Linking these two data sources provides hunting opportunities.
Logging from AzureActivity provides the IP address and UPN of the account that
invoked the command. Joining this with logging from MDE provides insights into
what cmdlets were loaded by the command.'
MDE host logging. Linking these two data sources provides hunting opportunities.
Logging from AzureActivity provides the IP address and UPN of the account that
invoked the command. Joining this with logging from MDE provides insights into
what cmdlets were loaded by the command.'
Run Whoami as SYSTEM
Sigma
Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par
Looks for a new MFA method added to an account that was preceded by medium or high risk sign-in session for the same user within maximum 6h timeframe
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
Detects the use of CoercedPotato, a tool for privilege escalation
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
UAC Bypass via Sdclt
Sigma
Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
Detect modification of the startup key to a path where a payload could be stored to be launched during startup
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Page 309 of 401