Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
'This composite hunting query will highlight any HTTP traffic in CommonSecurityLog web proxies (such as ZScaler) that match known patterns used by red teaming tools potentially stolen from FireEye. Most FireEye red teaming tools are designed to mimic
legitimate API activity, false positives are common. This query includes a basic check to determine how common a hostname is in you environment, and allows you to modify this threshold to remove legitimate traffic from the query results.
This query contains only a subset of potential FireEye red team tool communications, and therefore should not be relied upon alone :) .'
legitimate API activity, false positives are common. This query includes a basic check to determine how common a hostname is in you environment, and allows you to modify this threshold to remove legitimate traffic from the query results.
This query contains only a subset of potential FireEye red team tool communications, and therefore should not be relied upon alone :) .'
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
UAC Bypass via Sdclt
Sigma
Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Detects modification of autostart extensibility point (ASEP) in registry.
MFA Spamming
KQL
'Identifies list of user impacted by MFA Spamming within a given time window,Default Failure count is 10 with default Time Window is 5 minutes'
UAC Disabled
Sigma
Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Detects UAC bypass method using Windows event viewer
'This hunting query will identify instances where a single user account has seen a high incidence of failed attempts from highly volatile IP addresses
Changing IP address for every password attempt is becoming a more common technique amongst sophisticated threat groups. Often threat groups will randomise
the user agent they are using as well as IP address. This technique has been enabled by the emergence of services providing huge numbers of residential IP
addresses. These services are often enabled through malicious browser plugins. This query is best executed over longer timeframes.
Reduce the timeRange if you have too much data. Results with the highest "IPs", "Failures" and "DaysWithAttempts" are good candidates for further
investigation. This query intentionally does not cluster on UserAgent, IP etc. This query is clustering on the highly volatile IP behaviour.'
Changing IP address for every password attempt is becoming a more common technique amongst sophisticated threat groups. Often threat groups will randomise
the user agent they are using as well as IP address. This technique has been enabled by the emergence of services providing huge numbers of residential IP
addresses. These services are often enabled through malicious browser plugins. This query is best executed over longer timeframes.
Reduce the timeRange if you have too much data. Results with the highest "IPs", "Failures" and "DaysWithAttempts" are good candidates for further
investigation. This query intentionally does not cluster on UserAgent, IP etc. This query is clustering on the highly volatile IP behaviour.'
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Detects potential DLL sideloading of "chrome_frame_helper.dll"
Detects DLL sideloading of "dbgcore.dll"
Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.
Detects potential DLL sideloading of rcdll.dll
Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.
Page 330 of 401