Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,408 detections
Filters
Last updated
All Time
Detection languages
3,122
2,730
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,696
1,319
905
813
750
Platforms
5,933
913
886
299
280
Products / Services
1,617
1,401
1,091
454
419
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
Detects persistence registry keys for Recycle Bin
Detects value modification of registry key containing path to binary used as screensaver.
Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects UAC bypass method using Windows event viewer
Detects modification of autostart extensibility point (ASEP) in registry.
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation
Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Detects service installation in suspicious folder appdata
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
You can use it to reset the password of the local computer.
You can use it to reset the password of the local computer.
PowerShell ShellCode
Sigma
Detects Base64 encoded Shellcode
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)
Page 327 of 401