Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata
Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
This behavior has been observed in-the-wild by different threat actors.
This behavior has been observed in-the-wild by different threat actors.
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190
Detects usage of Msiexec.exe to install packages hosted remotely quietly
Detects a when net.exe is called with a password in the command line
Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.
Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects PowerShell execution to set the ACL of a file or a folder
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.
Page 37 of 61