Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicate WMI ActiveScriptEventConsumers activity. This is a common technique for persistence and privilege escalation.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen. This rule specifically looks for processes like cmd.exe or powershell.exe being launched by winlogon.exe, with command-line arguments indicating an attempt to leverage Windows accessibility features such as sethc.exe (Sticky Keys), utilman.exe (Utility Manager), osk.exe (On-Screen Keyboard), Magnify.exe, Narrator.exe, or DisplaySwitch.exe.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
Detects when an attacker registers a new SIP provider for persistence and defense evasion by monitoring modifications to the 'mpnotify' registry key under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\'. This registry key is associated with Winlogon helper DLLs, which can be abused to execute malicious code during user logon.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
This rule detects the creation of the Process Monitor (procmon) driver file (.sys) by any process other than the legitimate Process Monitor executable itself (procmon.exe or procmon64.exe). This behavior can indicate an attempt to load a malicious or unauthorized driver, potentially for privilege escalation or persistence, by masquerading as a legitimate system utility.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Detects the execution of the AdvancedRun utility, which can be used to launch applications with different user permissions, including SYSTEM, or with modified environment variables. This utility is often used for legitimate administrative tasks but can also be leveraged by adversaries for privilege escalation or defense evasion, particularly by running processes with hidden windows.
Detects the execution of the NSudo utility, a tool that allows users to run programs with elevated privileges such as System, Trusted Installer, or with all privileges enabled. The rule specifically looks for NSudo executable names and common command-line arguments used to request these elevated privileges.
Detects the execution of a renamed version of the "Mavinject" process. Mavinject.exe is a legitimate Microsoft utility that can be abused to perform process injection, often using the "/INJECTRUNNING" flag. This rule specifically looks for instances where the original file name (mavinject32.exe or mavinject64.exe) does not match the executed image name, indicating a potential rename for defense evasion.
Detects the creation of a specific '.url' file named 'file001.url' within the 'Recent' folder of Microsoft Office. This activity has been observed in potential exploitation attempts related to CVE-2023-36884, where adversaries drop such files to achieve persistence or execute malicious code.
Page 392 of 401