Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detection well-known mimikatz command line arguments
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious use of XORDump process memory dumping utility
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects suspicious process patterns used in NTDS.DIT exfiltration
Shadow Copies creation using operating systems utilities, possible credential access
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Adversaries may log user keystrokes to intercept credentials as the user types them.
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
This YARA rule detects the AwesomeScott ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for a combination of three distinct byte sequences related to file encryption ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) and one byte sequence related to file discovery ($find_files). All identified patterns must be present for a match, along with the standard Windows executable MZ header (uint16(0) == 0x5A4D).
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects the Kangaroo ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes (hex patterns) that are characteristic of the Kangaroo ransomware's code for encrypting files, locating files on the system, and enumerating resources.
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
Page 229 of 229