Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (lsass.exe) with sensitive access rights (e.g., PROCESS_VM_READ, PROCESS_QUERY_INFORMATION). These access patterns are frequently utilized by credential dumping tools like Mimikatz, ProcDump, or malicious abuse of system utilities to extract plaintext passwords or NTLM hashes from memory.
Detects instances where one process initiates an injection mechanism (such as CreateRemoteThread, QueueUserAPC, or NtMapViewOfSection) into another process. The rule specifically alerts when these actions target common, high-value, or frequently abused processes such as explorer.exe, svchost.exe, or web browsers (chrome.exe, firefox.exe, msedge.exe), which are common targets for maintaining persistence or evading detection.
Detects the execution of rclone.exe or a renamed rclone binary using common command-line arguments (copy, sync, config, --progress). Rclone is a popular tool for ransomware double-extortion, as it allows attackers to exfiltrate data to various cloud storage providers while blending into legitimate network traffic.
Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.
This rule detects potential Cobalt Strike SMB beacon activity by identifying the creation of suspicious named pipes (commonly associated with Cobalt Strike) and correlating them with low-jitter, uniform outbound network communication patterns typical of command and control (C2) beaconing behavior.
Detects the Print Spooler service (spoolsv.exe) spawning a shell/script interpreter or rundll32.exe as a child process, or loading a DLL from a driver-store/temp/ProgramData path — the process-injection and arbitrary-DLL-load pattern characteristic of PrintNightmare (CVE-2021-34527) exploitation.
This rule detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS). It specifically targets memory access (EventID 10) with sensitive access masks (e.g., PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ) originating from processes executing from suspicious locations such as Temp, AppData, Downloads, or randomly generated executable names. This method is often used by modern credential dumpers, such as those utilizing direct or indirect syscalls, to bypass userland security hooks.
Detects lateral movement patterns associated with PsExec or its variants. The rule correlates SMB administrative share access (ADMIN$ or IPC$), the subsequent installation of a service (often named PSEXESVC or using a temporary executable path), and the immediate execution of a command or shell (cmd.exe or powershell.exe) by that service.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments.
Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
Detects the use of Mimikatz-style command-line arguments to manipulate Kerberos tickets, including ticket requests, purges, and golden/silver ticket creation attempts.
This rule detects the execution of common tools and commands used to perform Kerberoasting, a technique where attackers request Kerberos service tickets for user accounts with Service Principal Names (SPNs) in order to perform offline brute-force attacks to recover plaintext credentials. The rule specifically monitors process creation events for known offensive security tools like Rubeus, as well as specific command-line arguments for 'setspn.exe' and various scripts that can be used to identify potential Kerberoasting targets.
Detects the use of Mimikatz 'sekurlsa::pth' command for credential manipulation, or the occurrence of SMB/Windows administrative share access (ADMIN$, C$) potentially indicating lateral movement activities.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs or perform encoding/decoding operations in suspicious directories (Temp, AppData). This activity is commonly used by adversaries for stage-one malware delivery or tool ingress.
Detects instances of rundll32.exe or regsvr32.exe executing from suspicious locations or with suspicious command-line arguments (e.g., URLs, JavaScript, or script file extensions) initiated by an unsigned process. This is a common technique used to proxy malicious code execution while evading security monitoring.
This rule detects common Cobalt Strike malleable profile named pipe creation events as well as network connections initiated by common LOLBins (Living Off the Land Binaries) that are unsigned, which is a common indicator of beaconing activity.
Detects the execution of script files with .js or .se extensions using wscript.exe or cscript.exe outside of standard system directories. This behavior is consistent with the More_eggs JScript backdoor, which has been utilized by the FIN6 threat group (also known as Skeleton Spider) to establish persistent backdoors for follow-on payload delivery.
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools, including AnyDesk, ScreenConnect, and TeamViewer, by monitoring process creation events. This behavior is indicative of social-engineering-based intrusions by the Scattered Spider (UNC3944/Octo Tempest) threat actor, who often impersonates IT support staff to convince users to run these tools for unauthorized remote access.
Detects the execution of regsvr32.exe with command line arguments containing 'scrobj.dll' and '/i:http'. This behavior indicates the abuse of the Windows Registry Server utility to load a remote COM scriptlet, a technique frequently observed in TA505 adversary activity to execute malicious payloads, such as the Get2 downloader or SDBbot RAT.
Detects the use of PowerShell to download content from a remote URI and execute it using encoded commands or expression evaluation, a pattern commonly used by the FIN8 threat group (Syssphinx) to deploy the BADHATCH backdoor.
Page 25 of 465