Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,408 detections
Filters
Last updated
All Time
Detection languages
3,122
2,730
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,696
1,319
905
813
750
Platforms
5,933
913
886
299
280
Products / Services
1,617
1,401
1,091
454
419
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Detects suspicious Powershell code that execute COM Objects
Detects the creation of a scheduled task via Registry keys.
Detects rare service installs that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious services
Detects rare scheduled tasks creations that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious code
Detects the default "UserName" used by the DiagTrackEoP POC
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Detects suspicious processes logging on with explicit credentials
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.
Run Whoami as SYSTEM
Sigma
Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.
New Service Creation
Sigma
Detects creation of a new service.
SCM DLL Sideload
Sigma
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
schtasks.exe create task from user AppData\Local\Temp
Detects a driver load from a temporary directory
Detects loading of known malicious drivers via the file name of the drivers.
Detects potential Dridex acitvity via specific process patterns
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Detects post exploitation execution technique of the Serpent backdoor.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
Detects execution of ChromeLoader malware via a registered scheduled task
Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)
Page 328 of 401