Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
This rule detects evidence of remote service installation and execution, commonly associated with tools like PsExec, PaExec, and RemCom, or the direct use of Windows administrative shares (ADMIN$, C$) to execute binaries remotely. The rule monitors for process creation events involving known service binary names, service creation attempts, or the execution of binaries staged in administrative network shares.
This rule detects suspicious NTLM network logon events (Logon Type 3) involving privileged accounts that do not have corresponding Kerberos authentication events (4768/4769) in the preceding hour. The detection specifically triggers when a single account logs into two or more distinct hosts within a 15-minute window, which is indicative of lateral movement using compromised credentials or Pass-the-Hash techniques.
Detects the deletion of Volume Shadow Copies and disabling of Windows boot recovery options using native administrative utilities such as vssadmin, wmic, powershell, wbadmin, and bcdedit. This behavior is frequently associated with pre-encryption activities in ransomware attacks to prevent system restoration.
Detects the loading of known vulnerable kernel drivers commonly used for Bring Your Own Vulnerable Driver (BYOVD) attacks, followed within 15 minutes by administrative attempts to stop, delete, or kill common security product processes or services.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects the use of PowerShell commands to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) on web application directories and configuration files, a technique often used by attackers to hide modifications made to webshells or malicious scripts.
This rule detects instances where a process matching a known sideload-vulnerable binary (such as werfaultsecure or wuauclt) spawns a PowerShell process that executes commands commonly used for Active Directory reconnaissance and system information discovery. This behavior is indicative of post-compromise activity, specifically reconnaissance phases performed by malware loaders like Lorem Ipsum.
This rule detects a credential-based attack where a single source IP performs multiple failed RDP (LogonType 3/10) attempts against various user accounts, followed by a successful authentication from the same source within an hour. This pattern is indicative of password spraying or brute-forcing followed by successful lateral movement via Remote Desktop.
Detects the insertion of a PowerShell download cradle command into the Windows Explorer RunMRU registry key. This activity is indicative of the 'ClickFix' technique, where a user is socially engineered to copy and paste a malicious command into the Windows Run dialog box.
This rule detects potential Remote Desktop Protocol (RDP) session hijacking or suspicious automation activity. It monitors for the execution of tscon.exe, a system utility used to control remote desktop sessions, or the usage of mstsc.exe (Remote Desktop Connection) over the standard RDP port 3389, which can be indicative of lateral movement or unauthorized access.
Detects techniques commonly used to dump Active Directory domain credentials by accessing the NTDS.dit database file. This includes the use of ntdsutil for IFM (Install From Media) operations, manual shadow copy creation using vssadmin or wmic to copy the ntds.dit file, direct access to shadow copy volumes containing sensitive database files, and the use of credential dumping tools like Impacket's secretsdump.
Detects the creation of services or remote execution indicative of PsExec usage over SMB administrative shares. This behavior is commonly associated with lateral movement techniques used by threat groups such as Black Basta (Storm-1811) to execute payloads on remote systems.
Detects Microsoft Office applications (winword.exe or excel.exe) spawning shell processes (cmd.exe or powershell.exe). This behavior is commonly associated with malicious VBA macro execution in weaponized Office documents used for malware delivery, such as Dridex.
Detects the use of Windows administrative tools (vssadmin, wbadmin, and bcdedit) to delete Volume Shadow Copies, backup catalogs, and disable system recovery mechanisms. This behavior is highly indicative of preparatory stages for destructive wiper malware attacks, such as those historically observed by the Sandworm (Seashell Blizzard) group (e.g., CaddyWiper, Industroyer2).
Detects instances where the Windows Explorer process (the parent of the 'Run' dialog) spawns common command-line interpreters. This behavior is indicative of the 'ClickFix' phishing technique, where users are socially engineered to paste malicious commands into the Windows Run dialog.
Detects the clearing of the Windows Security event log, which generates Event ID 1102. This action is often performed by adversaries to cover their tracks after performing malicious activities on a compromised host.
Detects instances where the SQL Server process (sqlservr.exe) initiates command-line utilities such as cmd.exe or powershell.exe, and further identifies suspicious command-line arguments often associated with post-exploitation activity like discovery, credential gathering, or file manipulation.
Detects suspicious command execution patterns involving cmd.exe or powershell.exe spawned by services.exe, or involving redirection to temporary files, which are consistent with Impacket-based remote service execution commonly associated with NeedyMantis malware deployment.
Detects the execution of the Windows finger.exe utility with a command-line argument containing an '@' symbol, which indicates a request to a remote host. This technique is often abused by adversaries for reconnaissance or to retrieve remote stagers or other payloads, as the finger protocol is rarely used in modern enterprise environments.
Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations.
When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
which then appears as a wsl.exe child of the legitimate System32 stub.
When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
which then appears as a wsl.exe child of the legitimate System32 stub.
Page 14 of 319