Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects powershell script installed as a Service
Detects CSExec service installation and execution events
Detects installation or execution of services
Detects Remote Utilities Host service installation on the target system.
Detects suspicious service installation commands
Detects PsExec service installation and execution events
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse
Detects service installation in suspicious folder appdata
Detects service installation with suspicious folder patterns
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Detects RDP session hijacking by using MSTSC shadowing
Detects when an admin share is mounted using net.exe
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detect use of PDQ Deploy remote admin tool
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects email exfiltration via powershell cmdlets
Page 58 of 61