Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects the execution of "whoami.exe" with the "/all" flag
Detects active directory enumeration activity using known AdFind CLI flags
Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
Use of reg to get MachineGuid information
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation
Detects the execution of "wmic" with the "group" flag.
Adversaries may attempt to find local system groups and permission settings.
The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
Adversaries may attempt to find local system groups and permission settings.
The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
Detects the export of the target Registry key to a file.
Detects the export of a crital Registry key to a file.
Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
Detects AdFind execution with common flags seen used during attacks
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.
Page 161 of 203