Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
Detects volume shadow copy mount via Windows event log
Eventlog Cleared
Sigma
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution
Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
Detects CSExec service installation and execution events
Detects Windows services that got terminated for whatever reason
Detects NetSupport Manager service installation on the target system.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects important or interesting Windows services that got terminated unexpectedly.
Detects the use of smbexec.py tool by detecting a specific service installation
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
Detects PDQDeploy service installation on the target system.
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Detects Obfuscated Powershell via VAR++ LAUNCHER
Page 48 of 61