Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
Detects execution of the Notepad++ updater (gup) to launch other commands or executables
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Detects potential process patterns related to Cobalt Strike beacon activity
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Detects the execution of the PurpleSharp adversary simulation tool
Detects usage of the Quarks PwDump tool via commandline arguments
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects the execution of SecurityXploded Tools
Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
Detects execution of the IEExec utility to download and execute files
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Detects the usage of the "net.exe" command to start a service using the "start" flag
Page 313 of 319