Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Detects a suspicious child process of userinit
Detects potentially suspicious child processes of KeyScrambler.exe
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)
Detects uncommon target processes for remote thread creation
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
Detects potential malicious modification of run keys by winekey or team9 backdoor
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Page 347 of 401