Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects potential DLL sideloading of "mscorsvc.dll".
Detects potential DLL sideloading of "7za.dll"
Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories).
Usually this technique is used to achieve UAC bypass or privilege escalation.
Usually this technique is used to achieve UAC bypass or privilege escalation.
Detects potential DLL sideloading of "DbgModel.dll"
Detects potential DLL sideloading using comctl32.dll to obtain system privileges
Detects potential DLL sideloading of "ShellDispatch.dll"
Detects loading and execution of an unsigned thor scanner binary.
Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
Detects the process injection of a LittleCorporal generated Maldoc.
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.
Detects suspicious encoded payloads in WMI Event Consumers
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location.
Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.
Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.
Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process
Detects the creation of a scheduled task via Registry keys.
Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Page 350 of 401