Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects execution of AppX packages with known suspicious or malicious signature
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
Detects the "IDiagnosticProfileUAC" UAC bypass technique
Detects a sudden spike in Windows RestartManager Event ID 10000. A proliferation of RestartManager events is a strong indicator of active file encryption by ransomware (like INC or Akira) attempting to kill processes that are locking target files.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
An attacker disables or weakens Windows auditing to reduce the visibility of system and user activity. This helps evade detection by security tools and analysts by preventing critical events from being recorded in Windows Event Logs.
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.
Detects the crash of lsass.exe caused by WLDAP32.dll, which is a strong indicator of exploitation of the LDAPNightmare vulnerability (CVE-2024-49113). This exploit causes a denial of service on unpatched Windows Servers.
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Detects a suspicious process spawning from an Outlook process.
Page 9 of 18