Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system.
When the sticky keys are "activated" the privilleged shell is launched.
When the sticky keys are "activated" the privilleged shell is launched.
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)
Detects execution of the Windows Kernel Debugger "kd.exe".
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege
Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
Detects installation of a new shim using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Detects using register-cimprovider.exe to execute arbitrary dll file.
Detects the creation of scheduled tasks that involves a temporary folder and runs only once
Detects a WMI backdoor in Exchange Transport Agents via WMI event filters
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
Detects the creation of a new service using the "sc.exe" utility.
Tasks Folder Evasion
Sigma
The Tasks folder in system32 and syswow64 are globally writable paths.
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Detects a suspicious child process of userinit
Page 338 of 401