Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,695
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects usage of the "systeminfo" command to retrieve information
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Detects a suspicious RDP session redirect using tscon.exe
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Detects WmiPrvSE spawning a process
Alerts on trust record modification within the registry, indicating usage of macros
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
Detects remote thread creation by PowerShell processes into "lsass.exe"
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Detects Azure Hybrid Connection Manager services querying the Azure service bus service
Detects a driver load from a temporary directory
Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence
The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.
The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Page 452 of 465