Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,695
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Detects usage of Gpg4win to encrypt files
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Detects suspicious powershell command line parameters used in Empire
Detects the use of KrbRelay, a Kerberos relaying tool
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detects usage of the Sharp Chisel via the commandline arguments
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Use of hostname to get information
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)
Detects password change for the computer's domain account or host principal via "ksetup.exe"
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects process dump via legitimate sqldumper.exe binary
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Detects when an admin share is mounted using net.exe
Page 450 of 465