Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (`A service was installed in the system`). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
Detects the enabling of the Windows Recall feature via registry manipulation.
Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects the installation of the AnyDesk remote access software service. This could indicate abuse if AnyDesk is not legitimately used within the environment. The rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, where the service name or image path contains 'AnyDesk' and the service name also contains 'Service'.
Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
This rule detects when one of the Windows Event Logs has been cleared. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system. The detection specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider, which indicates an event log has been cleared. It filters out certain channels that might be covered by other rules to avoid redundancy.
Detects when one of the critical Windows Event Logs (PowerShell, Sysmon, Security, System) is cleared. This activity is often performed by adversaries to remove traces of their actions and evade detection. The rule specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider across these important channels.
Detects suspicious parent process for cmd.exe
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675, also known as PrintNightmare. The rule specifically looks for EventID 808 with ErrorCode 0x45A or 0x7e, combined with keywords indicating a plug-in module load failure and common DLL names used in PrintNightmare Proof-of-Concept exploits.
This rule detects suspicious errors related to the Remote Desktop Protocol (RDP) that could indicate an attempt to exploit CVE-2019-0708, also known as BlueKeep. It specifically looks for Event IDs 56 or 50 generated by the 'TermDD' provider, which are associated with RDP session errors that can occur during exploitation attempts.
This rule detects the installation and execution of the PsExec service (PSEXESVC) on Windows systems. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation event. The rule then checks if the installed service's name is 'PSEXESVC' or if its image path ends with '\PSEXESVC.exe'. This is a common indicator of PsExec being used for remote execution.
This rule detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) using tools like Mimikatz or other exploits originating from a machine with 'kali' in its hostname. It specifically looks for Windows System event IDs 5805 or 5723 in conjunction with the keywords 'kali' or 'mimikatz'.
This rule detects potential exploitation attempts of CVE-2021-42287, a vulnerability related to Active Directory's SAM Account Name Spoofing. The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName attribute. This manipulation grants the attacker additional permissions on the object, enabling further changes. The detection specifically looks for Event IDs 16990 (Object class and UserAccountControl validation failure) and 16991 (SAM Account Name validation failure) from the Microsoft-Windows-Directory-Services-SAM provider, which indicate issues during the creation or modification of Active Directory objects that are characteristic of this attack.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
Detects the installation and execution of the 'csexecsvc' service, which is associated with the CSExec tool. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and correlates it with the service name 'csexecsvc' or an image path ending with '\csexecsvc.exe'.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
Page 54 of 61