Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects usage of "find" binary in a suspicious manner to perform discovery
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
This rule detects the NjRAT backdoor, a remote access Trojan (RAT). It identifies two main versions of the malware based on distinct byte patterns related to persistence mechanisms, command and control (connect, send, receive) functionalities, and system information gathering. The rule looks for specific sequences of bytecode instructions indicative of NjRAT's operational logic.
Detects suspicious command with /dev/tcp
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Detects usage of system utilities (only grep and egrep for now) to discover security software discovery
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Detects usage of "find" binary in a suspicious manner to perform discovery
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Detects read access to a domain user from a non-machine account
Detects non-system users failing to get a handle of the SCM database.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Detects DNS server discovery via LDAP query requests from uncommon applications
Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Page 191 of 203