Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
This rule detects the creation of files with a '.dll' extension that have names matching known Windows system DLLs (e.g., 'secur32.dll', 'tdh.dll') but are created in unusual or non-standard system directories. The rule specifically excludes common legitimate system directories like 'System32' and 'SysWOW64' to reduce false positives. This behavior can indicate an attempt at DLL sideloading or other defense evasion techniques where an attacker places a malicious DLL with a legitimate system DLL name in a location that a legitimate application might load it from.
Detects the creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory. This file can be used as a persistence mechanism because its content is executed whenever certain tools under "C:\WINDOWS\System32\oobe\" (e.g., Setup.exe) fail to run.
Detects the creation of the LiveKD driver (LiveKdD.SYS) by any process other than the legitimate LiveKD executables (livekd.exe or livek64.exe). This could indicate an attempt to load a malicious or unauthorized driver using a renamed or masqueraded process.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
Detects the creation of named pipes with specific patterns known to be used by Cobalt Strike's malleable C2 profiles. This rule identifies common pipe names and patterns associated with Cobalt Strike's inter-process communication, including generic profiles and those related to catalog change listeners.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Detects the pattern of User Account Control (UAC) Bypass using the ICMLuaUtil Elevated COM interface. This technique involves a specific parent process (dllhost.exe) launching with particular Process IDs associated with the ICMLuaUtil interface, which can be abused to elevate privileges without user interaction. The rule filters out legitimate WerFault.exe processes to reduce false positives.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
Detects when an attacker modifies the 'Debugger' value within the 'AeDebug' registry key to establish persistence. This mechanism ensures that a specified malicious executable or DLL is launched whenever an application crashes, providing a persistent foothold on the system.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects the creation of a file named 'livekd.dmp' in the 'C:\Windows\' directory, which is the default output file for LiveKD kernel memory dumps. This activity can indicate an attempt to perform live kernel debugging, potentially for privilege escalation or defense evasion purposes.
Detects the creation of Process Explorer drivers by processes other than Process Explorer itself. This activity can indicate that hack tools or malware are attempting to use the Process Explorer driver for privilege escalation, often by dropping the driver to disk, running a service with it, and then removing it.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). This method involves manipulating the registry to execute an arbitrary binary or script with elevated privileges when eventvwr.exe is launched. The rule specifically looks for file creation events in the 'RecentViews' directory associated with Event Viewer, where the creating process is not a standard system process (i.e., not originating from C:\Windows\System32\ or C:\Windows\SysWOW64\).
Page 393 of 401