Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects the execution of the reconnaissance tool Seatbelt. This rule identifies Seatbelt activity based on its executable name, original file name, description, and specific command-line arguments used for various discovery tasks, including DpapiMasterKeys, InterestingProcesses, InterestingFiles, CertificateThumbprints, Chromium data, CloudCredentials, CredEnum, CredGuard, FirefoxHistory, and ProcessCreationEvents. It also covers group-based commands like 'misc', 'remote', 'chromium', 'slack', 'system', 'user', and 'all', as well as output to a file.
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of 'whoami.exe' with the '/priv' or '-priv' command-line flag. This command is used to display the current user's security privileges and is often executed by adversaries after a successful privilege escalation to understand their new capabilities or during discovery phases.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
This rule detects the execution of 'driverquery.exe' or 'drvqry.exe' when initiated by specific parent processes or from suspicious directories. The parent processes include scripting engines like cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Additionally, the rule flags execution where the parent process image path contains common temporary or user-writable directories such as 'AppData\Local\', 'Users\Public\', or 'Windows\Temp\'. This combination aims to identify reconnaissance activity where an attacker is attempting to enumerate installed drivers on a system, potentially as part of a larger compromise, often associated with malware like Ursnif.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Detects the execution of the built-in Windows script 'gatherNetworkInfo.vbs' via cscript.exe or wscript.exe. This script is designed to gather detailed network information about the target machine, which can be leveraged by adversaries for reconnaissance purposes.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
This rule detects the execution of the 'whoami.exe' utility when its executable file name has been changed from the original 'whoami.exe'. Adversaries often rename legitimate system utilities to evade detection by security tools that monitor for specific process names. This technique is commonly used during the discovery phase to gather information about the compromised system's user context without triggering alerts associated with the standard 'whoami.exe' process name.
Detects the execution of "wmic" with the "group" flag to discover local system groups and their members. This activity can indicate an adversary attempting to map the environment for privilege escalation opportunities.
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Detects the execution of the `wmic.exe` utility with the `computersystem` flag to gather information about the machine, such as domain, username, and model. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects the enumeration of other remote systems.
Detects system information discovery commands
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Page 190 of 203