Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects long PowerShell command lines that perform in-memory assembly loading, often utilizing compression (GzipStream), encryption (Aes), or base64 decoding (FromBase64String). This combination is highly indicative of malicious payloads attempting to load reflective DLLs or executables directly into memory to evade file-based detection.
Detects the execution of the Windows Recovery Environment Configuration Tool (REAgentC.exe) with the '/disable' argument. Adversaries may use this command to inhibit system recovery, preventing users from using built-in Windows recovery options during or after a malicious event.
Detects attempts to clear Windows event logs using built-in utilities such as wevtutil.exe or PowerShell cmdlets (Clear-EventLog, Clear-WinEvent). Adversaries often perform this action to remove traces of malicious activity from the system.
Detects the execution of the Windows cipher.exe utility with the '/w' flag from the command prompt. The '/w' flag is used to overwrite free space on a disk, which is a technique often used by adversaries to perform data destruction or hinder forensic recovery of deleted files.
This rule detects the creation of .lnk files within the Windows Startup directory. Attackers frequently use this persistence technique to ensure that a malicious script or executable runs automatically upon user login.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Detects the use of the 'wevtutil.exe' utility to clear Windows Event Logs. This is a common technique used by adversaries to disrupt logging and evade detection of their actions on a host. The rule specifically monitors for the 'cl' (clear-log) command applied to sensitive operational channels, triggering when multiple clearing operations are detected within a 5-minute window.
Detects the presence of known artifacts associated with the GhostContainer backdoor, including indicators of Neo-reGeorg web shell usage, ysoserial payloads, and exploitation attempts targeting the CVE-2020-0688 vulnerability via VIEWSTATE manipulation.
Detects the execution of the Windows Diskpart utility using a script file, as indicated by the /s command-line argument. This behavior is often associated with malicious actors attempting to perform destructive operations such as removing recovery partitions to inhibit system recovery during ransomware attacks.
Detects when the ScreenConnect remote administration client process spawns common command-line or scripting interpreters. This behavior is indicative of an interactive session or remote command execution performed via the ScreenConnect tool, which is frequently abused by threat actors for lateral movement and remote control.
This rule monitors for suspicious activity originating from the WinRM service host (wsmprovhost.exe). It detects when command shells (cmd.exe, powershell.exe) are spawned by WinRM with known malicious command-line arguments (e.g., Evil-WinRM tools), monitors for the creation of potentially malicious configuration files (e.g., config.toml), and identifies established network connections to common WinRM ports (5985/5986) to detect unauthorized remote sessions.
Detects the execution of common command-line and scripting tools initiated by ScreenConnect (ConnectWise) remote administration processes. This pattern often indicates unauthorized remote access, lateral movement, or post-compromise activity where legitimate administrative software is abused to run arbitrary commands.
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
Detects instances where the ScreenConnect remote access client processes perform file creation or modification actions that are not preceded by or correlated with legitimate session activity logs (such as 'SessionConfirmed' or 'TransferFiles') within a 5-minute window. This behavior may indicate an unauthorized remote session or abuse of the remote access tool.
Detects instances where a service account (indicated by a trailing $ in the username, excluding computer accounts) authenticates to three or more distinct hosts within a short time frame. This behavior is indicative of potential lateral movement or automated discovery activities using a compromised service credential.
Detects instances where ConnectWise Control (ScreenConnect) agent services initiate the execution of processes that are not part of the standard ScreenConnect application suite. This behavior is often indicative of post-exploitation activity or malicious use of remote access tools to launch secondary payloads.
Detects the execution of the Rubeus tool, a C# toolkit used for interacting with the Kerberos protocol. The rule specifically monitors command-line arguments and process names associated with common Kerberos exploitation tasks such as Kerberoasting, Golden/Silver Ticket forging, and ticket manipulation.
This rule detects unauthorized attempts to perform Active Directory replication requests (DCSync) by monitoring for specific Event IDs (4662), activity types (DsGetNCChanges, DRSUAPI), and known Directory Replication Service (DRS) UUIDs. It specifically flags requests originating from non-Domain Controller assets or workstations, which is a common indicator of credential dumping via tools like Mimikatz.
Detects file creation, modification, or renaming events initiated by ScreenConnect (ClientService.exe or WindowsClient.exe) that are not accompanied by associated user confirmation, consent, or file transfer events. This can indicate an unauthorized or silent file manipulation by a remote actor using the ScreenConnect tool.
Detects multiple defense evasion techniques typically associated with the Monkey ransomware family, including clearing Windows Event Logs, clearing PowerShell command history, tampering with AMSI and ETW, modifying Microsoft Defender exclusions, and disabling Task Manager or CMD via registry keys.
Detects potential DCSync attacks by monitoring Windows Security Event ID 4662 for specific Directory Service Replication GUIDs. The rule identifies attempts by unauthorized principals (not domain controllers) to request replication data from the Active Directory domain controller, which is a key indicator of credential harvesting using tools like Mimikatz.
Page 302 of 1908