Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Detects the use of Windows Credential Editor (WCE)
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Files with well-known filenames (sensitive files with credential data) copying
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.
PktMon.EXE Execution
Sigma
Detects execution of PktMon, a tool that captures network packets.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
Shadow Copies storage symbolic link creation using operating systems utilities
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Page 228 of 229