Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the PowerShell command lines with special characters
Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Adversaries may abuse time providers to execute DLLs when the system boots.
The Windows Time service (W32Time) enables time synchronization across and within domains.
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious use of XORDump process memory dumping utility
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file
Detects command line parameters used by Bloodhound and Sharphound hack tools
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Commandline to launch powershell with a base64 payload
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Shadow Copies creation using operating systems utilities, possible credential access
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Detects suspicious PowerShell invocation with a parameter substring
Page 60 of 61