Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
490 detections
Filters
Last updated
All Time
Detection languages
406
57
13
12
1
Contributors
387
54
19
12
8
Categories
142
104
64
45
34
Platforms
385
30
19
18
13
Products / Services
205
136
62
40
27
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
CVEs
2
1
Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
Detects installation of suspicious packages using system installation utilities
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Detects disabling security tools
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects an appx package deployment that was blocked by the local computer policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects WRITE_DAC access to a domain object
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
Detects NetNTLM downgrade attack
Detects DCShadow via create new SPN
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Detects possible addition of shadow credentials to an active directory object.
Detects application popup reporting a failure of the Sysmon service
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Windows Defender logs when the history of detected infections is deleted.
Detects issues with Windows Defender Real-Time Protection features
Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.
Page 20 of 24