Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects unauthorized access to Windows Credential Manager vault
Detects attempts to dump LSASS memory for credential extraction
Detects abuse of trusted MSP remote management tools for initial access
Detects executables signed with invalid or self-signed certificates for masquerading
Detects bcdedit modification to boot in safe mode to bypass security tools
Detects Bluetooth OBEX protocol data transfers used for physical data exfiltration
Detects KernelCallbackTable manipulation for process injection via kernel callback
Detects reflective DLL loading technique that avoids writing files to disk
Detects users clicking malicious links that result in malware payload downloads
Detects keylogger captured data being exfiltrated via HTTP POST requests
Detects bulk file reading from removable media shares for data collection
Detects exploitation of unquoted service paths via SMB file placement
Detects screen capture image data being exfiltrated via HTTP POST
Detects legitimate system binaries renamed to evade detection
Detects connections to common proxy ports on potentially compromised servers
Detects keylogger-captured data exfiltration via HTTP POST requests
Detects access to underground exploit kit purchase or sales platforms
Detects creation of archives for staging collected data before exfiltration
Detects PowerShell command obfuscation techniques used to evade detection
Detects base64 encoded payloads in HTTP request bodies indicating obfuscation
Detects the creation or modification of a registry run key entry named 'DadaBank' within 'Software\Microsoft\Windows\CurrentVersion\Run'. This specific registry modification is associated with the LotusLite dropper, used by the Mustang Panda threat group, to establish persistence on a compromised system.
Page 413 of 509