Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
This analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment.
The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
This detection rule identifies uncommon or suspicious Remote Monitoring and Management (RMM) tools, leveraging intelligence from the LOL-RMM (Living Off the Land RMM) project. While RMM tools are widely used for IT administration, remote support, and network management, they are also frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. This rule detects RMM software that is not commonly observed in the environment, indicating potential unauthorized access or lateral movement.
Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.
This rule detects highly relevant antivirus events in the Windows Application log by looking for specific keywords associated with known virus signatures, malware, and offensive security tools. It aims to identify instances where an antivirus product has detected or quarantined malicious software or activity.
Detects suspicious parent process for cmd.exe
Detects the use of a Proof-of-Concept (PoC) tool designed to exploit the Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. The rule specifically looks for MsiInstaller Event ID 1033 with the data containing 'test pkg', which is indicative of the PoC's activity.
Detects command execution events originating from ScreenConnect, a legitimate remote administration tool. This rule specifically looks for Windows application log events where ScreenConnect is the provider and an event ID of 200 indicates a command of a certain length was executed. This activity can be indicative of an attacker using ScreenConnect for malicious purposes, such as executing arbitrary commands on a compromised system.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
Detects file being transferred via ScreenConnect RMM
Detects command execution via ScreenConnect RMM
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
Detects when a stored procedure in MSSQL is configured for automatic execution upon SQL Server startup using `sp_procoption`. This can be used by adversaries to establish persistence.
This rule detects the execution of the 'xp_cmdshell' stored procedure within Microsoft SQL Server. 'xp_cmdshell' allows SQL Server to execute operating system commands directly, which is a common technique used by attackers for privilege escalation, lateral movement, and persistence within a compromised environment. The detection specifically looks for EventID 33205 in the application log, indicating a SQL Server event, and checks for the presence of 'object_name:xp_cmdshell' and 'statement:EXEC' in the event data, confirming the execution of this procedure.
Detects the deletion of a backup catalog on Windows systems. This action can be performed by adversaries to inhibit system recovery, making it harder to restore systems after an attack, such as a ransomware incident.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server. This action is a strong indicator of an adversary attempting to evade detection by tampering with logging mechanisms.
Detects when an attacker attempts to establish persistence or escalate privileges on an MSSQL server by adding a new or existing account to the 'sysadmin' fixed server role. This action grants the account full administrative control over the SQL Server instance.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Page 16 of 18