Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Detects the execution of 'sc.exe' with the 'query' command-line argument to gather information about registered services on a Windows system. This activity can be indicative of discovery efforts by an attacker.
This rule detects attempts to gather system and hardware information on Linux systems by monitoring access to specific files and directories that contain details about the BIOS version, product name, chassis vendor, SCSI devices, IDE hard drive models, kernel version, and operating system release information. Adversaries often access these files during the discovery phase to understand the environment they have compromised.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
This rule detects attempts to enumerate source code repositories, specifically Git repositories, by looking for '.git/' in the URL of GET requests. This activity often indicates an attacker attempting to discover exposed source code.
This rule detects suspicious access attempts to the registry key associated with the Azure AD Health monitoring agent. It specifically looks for Event IDs 4656 (handle to an object was requested) or 4663 (an attempt was made to access an object) on the registry key '\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent'. The rule filters out access attempts made by legitimate Azure AD Health monitoring agent processes to reduce false positives. This detection requires specific SACL auditing to be configured on the registry key.
This rule detects the use of the PowerShell cmdlet 'Get-SmbShare', which adversaries may use to discover shared folders and drives on remote systems. This information can be leveraged for data collection or lateral movement within a network.
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects the execution of PowerShell cmdlets 'Get-NetFirewallRule' or 'Show-NetFirewallRule' to enumerate local firewall rules on a host. This activity is often performed by adversaries during the discovery phase to understand network configurations and potential egress/ingress points.
This rule detects the use of the 'grep' command on Linux systems to identify information about the operating system's architecture. Adversaries often combine this activity with other discovery commands like 'uname' or 'cat /proc/cpuinfo' to gather system details. The rule specifically looks for 'grep' executions where the command line arguments include common architecture strings such as 'aarch64', 'arm', 'i386', 'i686', 'mips', or 'x86_64'. This activity is indicative of an attacker attempting to understand the environment they have compromised.
This rule detects the usage of common macOS command-line utilities for file and directory discovery. Specifically, it looks for executions of '/usr/bin/file' with a very long command line (potentially indicating wildcard usage), '/bin/ls' with the recursive flag '-R', and direct executions of '/usr/bin/find' and '/usr/bin/mdfind'. It also includes a generic detection for '/tree' which might be a custom or less common utility for directory listing.
This detection identifies suspicious access attempts to registry keys and sub-keys associated with Azure AD Health service agents, such as AD FS. Gaining access to this information could enable an adversary to abuse features provided by these cloud services, particularly federation. The rule requires specific System Access Control List (SACL) auditing to be configured on 'HKLM:\SOFTWARE\Microsoft\ADHealthAgent' with propagation to sub-keys.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
This rule detects the execution of the Windows Kernel Debugger, 'kd.exe'. While kernel debuggers are legitimate tools, their execution in a production environment can indicate attempts at defense evasion, privilege escalation, or in-depth system analysis by an adversary. The rule specifically looks for the executable name 'kd.exe' either in the image path or the original file name.
Page 187 of 203