Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,207 detections
Filters
Last updated
All Time
Detection languages
2,408
1,433
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,142
1,814
1,762
1,292
888
Platforms
4,235
1,450
892
573
181
Products / Services
1,568
854
774
655
512
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise
Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise
Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2.
Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.
Detects DNS queries to domains associated with Katz Stealer malware.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.
Detects usage of the "type" command to download/upload data from WebDAV server
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Detects execution of the IEExec utility to download and execute files
Download and compress a remote file and store it in a cab file on local machine.
Detects suspicious ways to download files or content using PowerShell
Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Download or Copy file with Extrac32
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects execution of Chromium based browser in headless mode
Page 257 of 296