Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects NetSupport Manager service installation on the target system.
Detects PAExec service installation
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors
Detects password change for the logged-on user's via "ksetup.exe"
Detects when a share is mounted using the "net.exe" utility
Detects creation of local users via the net.exe command with the option "never expire"
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Detects usage of the "systeminfo" command to retrieve information
Detects WmiPrvSE spawning a process
USB Device Plugged
Sigma
Detects plugged/unplugged USB devices
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects volume shadow copy mount via Windows event log
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Detects the use of smbexec.py tool by detecting a specific service installation
Detects well-known credential dumping tools execution via service execution events
Page 57 of 61