Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Detects command line parameters used by Hydra password guessing hack tool
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects well-known credential dumping tools execution via specific named pipe creation
Detects PAExec default named pipe
Detects usage of Gpg4win to decrypt files
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects command line parameters or strings often used by crypto miners
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.
Detects default CSExec service filename which indicates CSExec service installation and execution
Detects suspicious file type dropped by an Exchange component in IIS
Detects files written by the different tools that exploit HiveNightmare
Detects a dump file written by QuarksPwDump password dumper
Page 448 of 465