Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,065 detections
Filters
Last updated
All Time
Detection languages
15,361
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,115
9,760
3,854
3,760
3,714
Platforms
40,065
7,331
6,542
3,907
3,666
Products / Services
10,442
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,120
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potential lateral movement via Remote Desktop Protocol (RDP) by identifying a single user account establishing RemoteInteractive (logon type 10) sessions to three or more distinct destination hosts within a 15-minute timeframe. This pattern is indicative of an attacker attempting to traverse a network from a compromised host.
Detects anomalous lateral movement behavior by monitoring Windows Event 4624 (Logon Type 3) using NTLM authentication. The rule triggers when a single user account authenticates to five or more distinct hosts within a five-minute window, a pattern frequently associated with Pass-the-Hash attacks where captured credentials are used to spread across a network.
Detects attempts to disable security services (Windows Defender, EDR agents), modify audit policies via auditpol, or stop/clear the Windows Event Log service. This behavior is a common precursor to post-compromise activity intended to blind defenders and conceal malicious actions.
Detects the execution of command-line archiving utilities (e.g., 7z, rar, zip) to create potentially password-protected archives within common staging directories (Temp, Public, ProgramData), followed by an outbound network connection to an external destination. This behavior is consistent with data staging and subsequent exfiltration.
Detects the 'ClickFix' attack pattern where explorer.exe (typically via a Run dialog interaction) spawns a command shell (PowerShell, cmd, or mshta) using obfuscated flags combined with execution indicators (download/execution), which then subsequently spawns a secondary child process. This chain provides high-confidence evidence of malicious intent compared to isolated process executions.
Detects the 'ClickFix' attack pattern where explorer.exe (typically via a Run dialog interaction) spawns a command shell (PowerShell, cmd, or mshta) using obfuscated flags combined with execution indicators (download/execution), which then subsequently spawns a secondary child process. This chain provides high-confidence evidence of malicious intent compared to isolated process executions.
This rule detects potential Kerberoasting activity by monitoring Kerberos Service Ticket requests (Event IDs 4768 and 4769) that utilize the weak RC4 encryption type (0x17). The rule filters for non-computer account activity and specific suspicious Ticket Options that are commonly associated with tool-based Kerberoasting attacks.
Detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory using common tools like Mimikatz, Procdump, or built-in system utilities such as comsvcs.dll or command-line arguments indicating memory dump operations.
Detects instances of rundll32.exe being used with suspicious command line arguments, such as referencing JavaScript, loading Control Panel applets (.cpl) via shell32.dll from non-standard locations, or executing DLLs directly from user-writable directories (Temp, AppData, Downloads, ProgramData). These patterns are common techniques used by adversaries to proxy execution and evade detection.
Detects the abuse of signed Windows system binaries regsvr32.exe and rundll32.exe for proxy execution, defense evasion, and credential access. The rule identifies suspicious command-line patterns including Squiblydoo (regsvr32 with remote scriptlets), rundll32 executing JavaScript via mshtml.dll, rundll32 performing LSASS credential dumping via comsvcs.dll, and the loading of DLLs from untrusted user-writable locations like Temp or Downloads folders.
Detects Kerberos service ticket requests (EventID 4769) that utilize RC4 encryption (0x17) instead of the more secure AES encryption. Attackers often force RC4-HMAC when requesting service tickets for accounts with Service Principal Names (SPNs) because these tickets are susceptible to offline brute-force attacks to recover service account passwords. This technique is a common precursor to lateral movement and privilege escalation in Active Directory environments.
Detects potential Pass-the-Hash (PtH) activity by monitoring for NTLM network logons (Logon Type 3) that are associated with a blank WorkstationName, often indicating spoofing. This pattern is correlated with the assignment of special privileges (EventID 4672) to capture scenarios where stolen NTLM hashes are replayed for lateral movement into a system.
Detects Kerberos service ticket requests (EventID 4769) that utilize RC4 encryption (0x17) instead of the more secure AES encryption. Attackers often force RC4-HMAC when requesting service tickets for accounts with Service Principal Names (SPNs) because these tickets are susceptible to offline brute-force attacks to recover service account passwords. This technique is a common precursor to lateral movement and privilege escalation in Active Directory environments.
Detects the execution of PowerShell commands that leverage obfuscation or evasion techniques such as Base64 encoded commands, hidden window styles, in-memory script downloads via IEX, and common string obfuscation methods like backtick insertion, character concatenation, and casting. These techniques are frequently used by adversaries to bypass command-line monitoring and execute malicious payloads.
Detects the use of legitimate Windows system utilities certutil.exe and bitsadmin.exe to perform remote file downloads or decode remote content. Adversaries often use these dual-use tools to bypass network security controls by masquerading as standard system processes for staging second-stage payloads.
This rule detects PowerShell processes (including pwsh and ISE) referencing Anti-Malware Scan Interface (AMSI) related classes and methods in their command line arguments. This is a common indicator of an attempt to interact with or manipulate AMSI, often used to bypass or disable security scanning during the execution of malicious scripts.
Detects instances where the WMI service (wmiprvse.exe) spawns common command-line or system tools such as cmd.exe, powershell.exe, or rundll32.exe. This behavior is often indicative of lateral movement or remote command execution via WMI.
Detects common suspicious PowerShell command-line patterns often used for malicious purposes, including base64-encoded command execution, hidden-window execution with common evasion flags, and the use of download/execution cmdlets for in-memory payload delivery.
This rule detects potential lateral movement by identifying a single user account authenticating to three or more distinct hosts using NTLM via network (LogonType 3) or impersonation (LogonType 9) logons, which is characteristic of credential-based movement across a network.
Detects Sysmon Event ID 10 (ProcessAccess) events where a process opens lsass.exe with a GrantedAccess mask matching known credential-dumping access rights (e.g. PROCESS_VM_READ combinations used by Mimikatz/ProcDump-style tooling), excluding common legitimate EDR/AV/diagnostic source processes.
This rule monitors for process creation events where the parent process is identified as the WMI Provider Host (wmiprvse.exe) or the Windows Management Instrumentation Command-line (wmic.exe) tool, executing a Win32_Process creation command. This pattern is commonly used by adversaries for remote execution and lateral movement.
Page 116 of 1908