Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This rule detects the execution of `find.exe` or `findstr.exe` on Windows systems when used to search for keywords commonly associated with security tools. Attackers often use these utilities to discover installed security software by piping the output of other reconnaissance commands (like `tasklist` or `whoami`) through `findstr` to filter for specific terms. The rule specifically looks for command-line arguments containing keywords such as "avira", "cb", "cylance", "defender", "kaspersky", "kes", "mc", "sec", "sentinel", "symantec", and "virus", including variations with double quotes.
Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.
Detects the usage of `findstr.exe` in combination with keywords like "Everyone" or "BUILTIN" to identify potentially misconfigured file or folder permissions. This activity is often seen during reconnaissance phases by adversaries looking for privilege escalation opportunities.
Detects the execution of the 'whoami.exe' command by highly privileged accounts such as 'AUTHORITY\SYSTEM', 'NT AUTHORITY\SYSTEM', or 'TrustedInstaller'. This activity can indicate an attacker performing discovery after achieving privilege escalation, as these accounts are often targeted for abuse.
Yara rule that detects Cicada3301 ransomware.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Detects the execution of common network scanning and reconnaissance tools on Linux systems. These tools are often used by adversaries to enumerate local or remote network services, identify open ports, and gather information about network topology and available hosts. The rule specifically looks for the execution of tools like netcat (when not in listen mode), nmap, hping, naabu, autorecon, and telnet.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects the execution of 'Advanced Port Scanner' based on its image name, original file name, description, or specific command-line arguments. This tool is often used for network reconnaissance.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects enumeration of local network configuration
This rule detects activity related to AzureHound, a BloodHound data collector specifically designed for Microsoft Azure environments. It identifies AzureHound's presence by looking for its default 'User-Agent' string in Azure sign-in logs after a successful authentication (ResultType: 0). This indicates that an authenticated user or service principal is using AzureHound to enumerate Azure resources, which is often a precursor to further reconnaissance or privilege escalation within a cloud environment.
This rule detects the execution of BloodHound and SharpHound, which are reconnaissance tools used to map Active Directory environments. It identifies these tools by their product name, description, company name, executable image names, and specific command-line arguments often used for data collection, such as 'CollectionMethod All', '--Loop', '--PortScanTimeout', '-JsonFolder', '-ZipFileName', 'DCOnly', and '--NoSaveCache', as well as PowerShell cmdlets like 'Invoke-Bloodhound' and 'Get-BloodHoundData'.
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
Page 183 of 203