Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects system enumeration events as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the use of powershell to enumerate successful logins on a specific host
Detects the execution of the 'esxcli' command with the 'vm' flag to retrieve information about installed virtual machines on an ESXi hypervisor. This activity can be part of discovery phase by adversaries targeting ESXi environments.
Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.
Detects identities attempting to enumerate their Kubernetes RBAC permissions.
In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
Detect the update check performed by Advanced IP/Port Scanner utilities.
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.
Detects remote RPC calls to read information about scheduled tasks via AtScv
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
Detects remote RPC calls to get event log information via EVEN or EVEN6
Detects remote RPC calls to read information about scheduled tasks
Detects remote RPC calls to collect information
Detects remote RPC calls to read information about scheduled tasks via SASec
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
Detects the execution of the 'esxcli' command with the 'storage' flag to retrieve information about storage status on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware.
Detects the execution of the "esxcli" command with the "vsan" flag to gather information about virtual storage on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware, indicating potential reconnaissance or preparation for impact on virtualized environments.
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on logs containing process details and command-line executions. This activity is significant as it may indicate suspicious behavior, such as a user or process gathering detailed process information, which is uncommon for non-technical users. If confirmed malicious, this could allow an attacker to gain insights into running processes, aiding in further exploitation or lateral movement.
Page 170 of 203