Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
This rule detects modifications to the Internet Explorer ZoneMap Domains registry key, which can be used to add domains to specific security zones (e.g., Trusted Sites). Adversaries might modify these settings to lower security restrictions for malicious websites or to bypass security prompts.
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Detects potentially suspicious child processes of WinRAR.exe.
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
RDP login with localhost source address may be a tunnelled login
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects command line parameters or strings often used by crypto miners
Detects read access to a domain user from a non-machine account
Detects access to ADMIN$ network share
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Detects external disk drives or plugged-in USB devices.
Detects well-known credential dumping tools execution via service execution events
Alerts on Metasploit host's authentications on the domain.
Detects powershell script installed as a Service
Detects non-system users failing to get a handle of the SCM database.
Page 308 of 319