Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Detects the execution of Nmap or Zenmap, which are network scanning tools. Adversaries commonly use these tools for network service discovery to identify open ports and services on remote hosts, potentially looking for vulnerabilities to exploit.
This rule detects the execution of common Linux commands used for system information discovery. Specifically, it looks for processes ending with '/uname', '/hostname', '/uptime', '/lspci', '/dmidecode', '/lscpu', and '/lsmod'. These commands are frequently used by adversaries to gather details about the operating system, hardware, and loaded modules on a compromised system.
This rule detects the execution of the `systeminfo.exe` command, which is used to retrieve detailed system information. Adversaries often use this command during the discovery phase to gather information about the compromised system's operating system, hardware, and installed software. This information can help them understand the environment and plan subsequent actions.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
Detects the execution of the 'ls -id /' command, which is a common technique used by adversaries to determine if they are running inside a container. The number of inodes for the root directory is typically much higher inside a containerized environment compared to a bare-metal system.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects the execution of common Linux utilities used to discover system network connections and logged-in users. Specifically, it looks for 'who', 'w', 'last', 'lsof', and 'netstat' commands. It filters out legitimate calls from '/usr/bin/landscape-sysinfo' when 'who' is used.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Page 185 of 203