Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects remote RPC calls to get event log information via the EVEN or EVEN6 interfaces, which can be indicative of reconnaissance activity by an attacker. This rule specifically targets RPC Firewall logs for these interface UUIDs.
This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.
This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.
This rule detects the use of PowerShell to enumerate successful logon events (Event ID 4624) from the security event log on a Windows host. It specifically looks for command-line executions containing 'Get-EventLog', 'security', and '-instanceid 4624'. This activity is often performed during the reconnaissance phase by adversaries to understand user activity on a system.
Detects remote RPC calls to read information about scheduled tasks via AtScv. This activity can indicate an adversary performing reconnaissance to understand the environment and identify potential lateral movement opportunities.
Detects uncommon network connections to the Active Directory Web Services (ADWS) on port 9389 from processes not typically associated with ADWS management. This can indicate an adversary performing discovery of Active Directory information.
This rule detects outbound network connections to IP addresses that are identified as Indicators of Compromise (IOCs) within a threat intelligence platform, specifically MISP. It filters out connections to RFC1918 private IP ranges to reduce false positives. The rule correlates network connection events with ingested MISP data to identify malicious communication.
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
Whoami Command Execution
YARA-L
Detects the execution of the 'whoami' command, which is frequently used by attackers post-exploitation to identify the current user's credentials and privileges. This activity is a common step in reconnaissance and privilege escalation phases of an attack.
This rule detects the creation of new files or the launch of processes whose SHA256 hash matches an indicator of compromise (IOC) from a MISP feed. It correlates process launch or file creation events with known malicious SHA256 hashes ingested from MISP, indicating potential malware execution or presence on a system.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics such as image name, original file name, or description containing 'Crassus'. This tool is used for reconnaissance and discovery activities on a compromised system.
Detects the execution of 'TruffleSnout.exe', a tool designed for iterative Active Directory discovery, situational awareness, and targeted low-noise enumeration. This rule identifies the tool by its original filename or by the executable's image path ending with 'TruffleSnout.exe'.
This rule detects the use of 'sc.exe' to query and enumerate services, specifically looking for the 'termservice'. Attackers often use 'sc.exe' to gather information about running services on a system, which can help them identify potential attack vectors or sensitive services. The detection focuses on the execution of 'sc.exe' with the 'query' command and the specific service 'termservice'.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.
Yara rule that detects Skuld infostealer.
Yara rule that detects VanHelsing ransomware.
This rule detects processes that query known third-party application registry keys that are known to store credentials. The detection specifically looks for command-line arguments containing paths to registry keys associated with applications like Foxmail, DownloadManager, CoreFTP, IncrediMail, WinSCP, MobaXterm, OpenSSH, OpenVPN, Radmin, Eudora, RealVNC, B2, PuTTY, and TightVNC. This activity often indicates an adversary attempting to discover or extract credentials stored by these applications.
Local Accounts Discovery
YARA-L
Local accounts, System Owner/User discovery using operating systems utilities
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Page 169 of 203