Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
131 detections
Filters
Last updated
All Time
Detection languages
50
32
28
6
5
Contributors
48
34
18
8
6
Categories
65
56
27
19
11
Platforms
99
20
10
4
4
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
51
42
26
25
18
CVEs
1
1
1
1
1
IDS Classtypes
4
1
IDS Protocols
4
1
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
Detects suspicious child processes spawned by the SQL Server process (sqlservr.exe). This activity is highly indicative of successful exploitation, such as Remote Code Execution (RCE) or SQL Injection, where an attacker leverages the SQL Server to execute arbitrary commands on the underlying operating system. The rule specifically looks for common system utilities and scripting interpreters that are often used by attackers for reconnaissance, persistence, or further compromise.
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Detects dump of credentials in VeeamBackup dbo
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
Page 7 of 7