Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools
Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
Detects scheduled task creation events that include suspicious actions, and is run once at 00:00
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Detects creation of a scheduled task with a GUID like name
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Detects service path modification via the "sc" binary to a suspicious command or path
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)
Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Detects various execution patterns of the CrackMapExec pentesting framework
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Detects scheduled task creations that have suspicious action command and folder combinations
Page 337 of 401