Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects potential exploitation attempts of the Zerologon vulnerability (CVE-2020-1472) by monitoring for Domain Controller machine account password resets (Event 4742) targeting DC computer accounts, and insecure Netlogon RPC channel events (Event 5829) triggered when vulnerable clients or tools attempt connections.
This rule identifies potential lateral movement or account compromise by detecting accounts that have performed NTLM network logons or authentication (Events 4624/4776) without corresponding Kerberos pre-authentication or interactive logon events within a 15-minute window. This pattern often indicates the use of stolen credentials (e.g., Pass-the-Hash) to access network resources rather than standard interactive user activity.
Detects usage of the Rclone utility (or renamed binaries) to transfer data to various cloud storage backends (S3, Mega, pCloud, SFTP, WebDAV). The detection correlates this activity with the execution of common archival tools (7-Zip, WinRAR, TAR) within one hour prior to the data transfer, which is a common behavior of adversaries preparing data for exfiltration.
Detects high volumes of TGS-REQ events using RC4 encryption (etype 0x17) originating from a single account within a 10-minute window, excluding known service accounts and computer accounts. This pattern is often indicative of an adversary attempting to harvest service account tickets for offline brute-force cracking.
This rule detects potential Golden Ticket activity by identifying Kerberos TGS requests (Event ID 4769) that lack a corresponding prior TGT request (Event ID 4768) for the same user and IP address. This behavior is characteristic of offline forged Kerberos tickets where an attacker uses a compromised KRBTGT hash to create authentication tickets without interacting with the Key Distribution Center for the initial TGT.
Detects attempts to dump the Local Security Authority Subsystem Service (LSASS) process memory for credential harvesting. The rule monitors for unauthorized process access requests (e.g., PROCESS_VM_READ), suspicious file creation of memory dumps in common writeable directories, and command-line execution of tools or techniques commonly associated with LSASS dumping (e.g., Mimikatz, procdump, or abusing comsvcs.dll).
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files from remote locations using the 'urlcache', 'verify', or 'verifyctl' arguments. Attackers often leverage this LOLBIN to download malicious payloads as it is a trusted system binary.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies or modifying Windows Boot Configuration Data, a technique commonly employed by LockBit and other ransomware families prior to file encryption.
Detects msiexec.exe spawned from explorer.exe, consistent with a user double-clicking a malicious .lnk shortcut, where the command line triggers the installation of an MSI package hosted on a remote HTTP/HTTPS server. This behavior is a known initial access technique used by FIN7 to deliver malicious payloads.
Detects command-line indicators associated with destructive disk-wiping activity, specifically targeting disk structure corruption to render systems unbootable. This rule monitors for unauthorized use of the Windows 'diskpart' utility, direct raw physical drive access, and specific file system utility commands (fsutil) frequently observed in wipers attributed to APT44 (Sandworm).
Detects Microsoft Outlook initiating outbound SMB or WebDAV network connections to external IP addresses. This behavior is indicative of exploitation of CVE-2023-23397, where a malicious reminder sound or attachment forces the victim's client to authenticate against an attacker-controlled remote share, potentially leaking NTLM hashes.
Detects instances where AI agent runtime processes (e.g., Python, Node.js) initiate child processes using common Windows Living-off-the-Land Binaries (LOLBAS). This behavior may indicate an AI agent has been compromised or misused to execute unauthorized system commands for defense evasion or post-exploitation activities.
Detects a sequence of events where a suspected sideloaded process (e.g., masquerading as common tools like curl or vim) is followed within 30 minutes by the registration of a new Windows service, a behavioral pattern associated with the NeedyMantis threat group.
Detects the execution of the encryptbase64.ps1 PowerShell script when invoked by a process other than PowerShell or PowerShell Core. This behavior is indicative of NeedyMantis malware attempting to evade detection by executing scripts outside standard script hosts.
Detects the use of 'findstr' or PowerShell to query sensitive configuration files (such as web.config or applicationHost.config) for credential-related keywords like 'connectionString', 'AccountKey', or 'machineKey'. This behavior is indicative of an adversary attempting to harvest credentials or sensitive configuration data stored in cleartext on the filesystem.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Detects the use of legitimate Windows administrative tools (vssadmin, wmic, wbadmin, bcdedit, sc, net) to delete volume shadow copies, clear backup catalogs, disable boot recovery options, or stop critical backup and system services. This behavior is highly characteristic of ransomware activity aiming to prevent data restoration and system recovery.
Detects a suspicious burst of commands commonly used to disable security services, antivirus, or backup agents on a single host. The rule monitors for a high frequency of taskkill, net stop, sc stop, or PowerShell Stop-Service operations targeting a predefined list of sensitive security software process and service names within a short timeframe, which is a common precursor to ransomware encryption.
This rule detects potential identity-led lateral movement in two scenarios: 1) A single account performing RDP authentications to multiple distinct hosts within a short time frame (RDP Fan-Out), or 2) An RDP login occurring on a host shortly after evidence of LSASS process memory access on that same host, suggesting potential credential theft followed by immediate reuse.
Detects the execution of known portable network scanning utilities such as SoftPerfect NetScan and Advanced IP Scanner. These tools are frequently abused by threat actors for network enumeration and service discovery to facilitate lateral movement within a compromised environment.
Detects the creation of a scheduled task using schtasks.exe that involves 'keyroll' in the command line. This pattern specifically flags tasks associated with the 'rnpkeys.exe' utility or tasks being created within 'keyroll' directories, which may indicate the deployment or maintenance of unauthorized key management or persistence mechanisms.
Page 16 of 319