Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.
This rule detects the installation of Microsoft Installer (MSI) packages from suspicious file system locations. It specifically looks for MsiInstaller events (Event IDs 1040 and 1042) where the installation source path contains known suspicious directories such as Windows temporary folders, remote shares (indicated by '\\'), Desktop, PerfLogs, or Public user folders. The rule includes filters to reduce false positives from legitimate applications like WinGet or specific update health tools.
This rule detects attempts to dump the NTDS.dit database to suspicious locations. It specifically looks for ESENT event ID 325 (New Database Created) where the data contains 'ntds.dit' and the path includes common suspicious directories such as Appdata, Desktop, Downloads, Perflogs, Temp, or Users\Public.
This rule detects when the deployment of an AppX package is blocked by the local computer policy. This can indicate an attempt to install an unauthorized application that is being prevented by system controls. The rule specifically looks for EventIDs 441, 442, 453, and 454 from the Microsoft-Windows-AppXDeployment-Server event source.
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
This rule detects when an application has been uninstalled from a Windows system. It specifically looks for MsiInstaller events with EventIDs 1034 (Windows Installer removed the product) or 11724 (Product Removal Successful). This can be an indicator of an adversary attempting to remove security software or other critical applications to hinder detection or response efforts, or simply to clean up their tracks.
This rule detects suspicious activity related to the Windows User Profile Service, specifically looking for EventID 1511 (Windows cannot find the local profile and is logging you on with a temporary profile) from the 'Microsoft-Windows-User Profiles Service' provider. This event, especially when combined with EventID 1515 (user profile loaded successfully) and the creation of a '\Users\TEMP' directory, can indicate an attempt to exploit vulnerabilities like CVE-2021-34484 or CVE-2022-21919 for privilege escalation. The rule focuses on the initial indication of a temporary profile being loaded.
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability
Detects usage of the "systeminfo" command to retrieve information
Detects WmiPrvSE spawning a process
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
An application has been removed. Check if it is critical.
Detects MSI package installation from suspicious locations
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Page 17 of 18