Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects email exfiltration via powershell cmdlets
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Detects the PowerShell command lines with special characters
Detects command line parameters used by Bloodhound and Sharphound hack tools
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Page 18 of 18