Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.).
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
Monitors for unexpected process termination or instability events associated with the Windows Netlogon service or lsass.exe (Event IDs 1000, 7031, 7034). This may indicate a failed buffer overflow exploitation attempt related to CVE-2026-41089, which could lead to a denial of service.
This rule detects repeated crashes and restarts of the SolarWinds Serv-U application, indicated by specific event log entries from 'Service Control Manager' or 'Application Error' sources. This pattern is consistent with known exploitation attempts targeting Serv-U.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Process Creation of LOLRMM Tools
Gravwell
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
Detects the creation or modification of registry run keys associated with the BoldTealLayer persistence mechanism, specifically targeting 'BoldTealLayer150'.
Detects the clearing of Windows event logs using command line tools like wevtutil or PowerShell. This is a standard example rule.
This rule extracts and normalizes Windows Event Logs from both SecurityEvent and Event tables within a 24-hour window. It serves as a foundational query to gather general Windows event logs, similar to what a 'wineventlog' source would provide, and normalizes key fields for consistent security hunting and analysis. The rule specifically projects fields such as TimeGenerated, Computer, EventLog, EventID, SourceName, Level, and Message from both log sources.
Detects the usage of 'wevtutil.exe' to clear critical Windows event logs (Application, Security, System, Windows PowerShell). This activity is often associated with defense evasion tactics used by adversaries, including ransomware like VECT, to remove forensic evidence.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
Detects attempts to disable security event logging by adding the `MiniNt` registry key.
This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
Detects attempts to disable Windows EventLog autologger sessions via registry modification.
The AutoLogger event tracing session records events that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
The AutoLogger event tracing session records events that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings.
Threat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.
Threat actors may modify these registry keys to redirect the loading of 'oci.dll' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service.
Detects when the 'AllowMultipleTSSessions' value is enabled.
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs
Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows.
EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process.
This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process.
This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
Page 32 of 61