Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
In this query, we are looking for emails containing malware accessed on a unmanaged device
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
Detects DLL sideloading activity seen used by Diamond Sleet APT
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Control Panel Items
Sigma
Detects the malicious use of a control panel item
Detects the execution of AdvancedRun utility
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Detects modification of autostart extensibility point (ASEP) in registry.
Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Detects the pattern of a pipe name as used by the hack tool EfsPotato
'Often times after the initial compromise the attackers create inbox rules to delete emails that contain certain keywords.
This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/'
This is done so as to limit ability to warn compromised users that they've been compromised. Below is a sample query that tries to detect this.
Reference: https://www.reddit.com/r/sysadmin/comments/7kyp0a/recent_phishing_attempts_my_experience_and_what/'
In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Page 315 of 401