Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
Detects the execution of netsh with the "add helper" flag to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy, getting called whenever netsh.exe is executed.
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Detects the installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Detects the creation of the LiveKD driver file (LiveKdD.SYS) by the LiveKD or LiveK64 executables. LiveKD is a tool used for live kernel debugging, which can be leveraged by adversaries for defense evasion or privilege escalation by interacting directly with the kernel.
Detects a potential privilege escalation attempt by monitoring the creation of specific ".Exe.Local" folders within the "System32" directory. This technique is used to sideload "comctl32.dll" into legitimate Windows processes, which can lead to privilege escalation or persistence.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
This rule detects the creation of named pipes with specific naming conventions commonly used by Cobalt Strike. Cobalt Strike is a legitimate penetration testing tool that is frequently misused by threat actors for post-exploitation activities. The rule looks for pipe names containing "\MSSE-" and "-server", or starting with "\postex_", "\status_", "\msagent_", "\mojo_", "\interprocess_", "\samr_", "\netlogon_", "\srvsvc_", "\lsarpc_", or "\wkssvc_". These patterns are indicative of Cobalt Strike's beacon communication or other internal operations.
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Detects the execution of the AdvancedRun utility when it attempts to run a process with elevated privileges, specifically in the context of TrustedInstaller, SYSTEM, Local Service, or Network Service accounts. This tool can be used by adversaries for privilege escalation and defense evasion.
Detects the installation of a potentially suspicious new shim database using sdbinst.exe where the command line does not contain common, legitimate file extensions or flags. Adversaries may use application shimming for persistence or privilege escalation.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.
Page 394 of 401