Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,408 detections
Filters
Last updated
All Time
Detection languages
3,122
2,730
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,696
1,319
905
813
750
Platforms
5,933
913
886
299
280
Products / Services
1,617
1,401
1,091
454
419
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt
Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.
load malicious registered COM objects
Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Detects a when net.exe is called with a password in the command line
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.
Detects when a program changes the default file association of any extension to an executable.
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable
Page 329 of 401