Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,003 detections
Filters
Last updated
All Time
Detection languages
732
640
208
129
126
Contributors
374
315
226
187
119
Categories
565
420
368
284
263
Platforms
1,428
228
198
197
98
Products / Services
443
284
282
147
129
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
2,003
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects blocking of process creations originating from PSExec and WMI commands
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects when a share is mounted using the "net.exe" utility
Detects suspicious Plink tunnel port forwarding to a local port
Detects a suspicious RDP session redirect using tscon.exe
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
Detects execution of Impacket's psexec.py.
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects remote service activity via remote access to the svcctl named pipe
Detects the use of smbexec.py tool by detecting a specific service installation
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Page 94 of 96