Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential lateral movement and persistence activities by identifying suspicious Windows service installations via event ID 7045. The rule flags services with suspicious names or paths (e.g., Temp folders, Public directory) and correlates them with incoming SMB connections (port 445) or services spawned directly by services.exe from suspicious locations, aggregated by host and remote IP.
Detects the execution of the Microsoft HTML Application host (mshta.exe) when it is used to launch scripts from remote URLs (http/https/ftp) or when it spawns common command-line shells and scripting engines, which is a common indicator of living-off-the-land techniques used to execute malicious payloads.
Detects DCSync attacks by monitoring for EventID 4662 where Active Directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) are requested. This behavior is indicative of unauthorized replication attempts used to extract sensitive data, such as password hashes, directly from a Domain Controller.
This rule identifies potential command and control (C2) beaconing activity by detecting periodic, low-jitter outbound network connections. It analyzes network logs to find connections to external IP addresses that maintain a consistent frequency over a period of time, specifically flagging hosts that demonstrate repetitive traffic patterns with low variation (jitter). The rule further filters by identifying 'rare' destinations, focusing on remote IPs that have been connected to by three or fewer hosts within the environment, which is a common indicator of targeted C2 infrastructure.
Detects Kerberos ticket requests (AS-REQ/TGS-REQ) that exhibit characteristics of a forged Golden Ticket, specifically the use of legacy RC4 (0x17) encryption in environments where AES is typically preferred, non-standard ticket options (0x40810000), and requests for accounts or services that lack a corresponding legitimate authentication event. This detection aims to identify the post-compromise phase where an adversary uses a forged TGT to impersonate domain accounts.
Detects the execution of rclone.exe or a renamed rclone binary using common command-line arguments (copy, sync, config, --progress). Rclone is a popular tool for ransomware double-extortion, as it allows attackers to exfiltrate data to various cloud storage providers while blending into legitimate network traffic.
This rule detects PowerShell processes (including pwsh and ISE) referencing Anti-Malware Scan Interface (AMSI) related classes and methods in their command line arguments. This is a common indicator of an attempt to interact with or manipulate AMSI, often used to bypass or disable security scanning during the execution of malicious scripts.
Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.
This rule detects modifications to Windows Registry 'Run' or 'RunOnce' keys that point to executables or scripts located within suspicious user-writable directories such as AppData, Temp, or Users Public. This is a common technique used by adversaries to establish persistence on a compromised host.
Detects the execution of known Windows system binaries (rundll32, regsvr32, mshta, msiexec) with command-line arguments indicative of proxy execution or script-based attacks. The rule identifies patterns commonly associated with downloading or executing remote payloads, including the use of URLs, JavaScript, VBScript, or specific DLL exports designed to execute code indirectly or from a remote source.
Detects the invocation of Active Directory replication rights by monitoring Event 4662 for specific directory service replication GUIDs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All). This behavior is characteristic of adversary techniques such as DCSync used by tools like Mimikatz lsadump::dcsync or Impacket secretsdump to extract domain password hashes.
Detects potential C2 beaconing activity by identifying repeated network connections to the same external host that exhibit consistent payload sizes (low variance) and frequency, or by flagging HTTP requests containing default URI patterns associated with Cobalt Strike profiles.
This rule detects potential Cobalt Strike SMB beacon activity by identifying the creation of suspicious named pipes (commonly associated with Cobalt Strike) and correlating them with low-jitter, uniform outbound network communication patterns typical of command and control (C2) beaconing behavior.
Detects the Print Spooler service (spoolsv.exe) spawning a shell/script interpreter or rundll32.exe as a child process, or loading a DLL from a driver-store/temp/ProgramData path — the process-injection and arbitrary-DLL-load pattern characteristic of PrintNightmare (CVE-2021-34527) exploitation.
Detects Active Directory enumeration consistent with BloodHound/SharpHound collection: SharpHound.exe or PowerView cmdlet process/command-line signatures, matching PowerShell script block log content, and bursts of LDAP traffic (ports 389/636) from a single source to a domain controller.
This rule detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS). It specifically targets memory access (EventID 10) with sensitive access masks (e.g., PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ) originating from processes executing from suspicious locations such as Temp, AppData, Downloads, or randomly generated executable names. This method is often used by modern credential dumpers, such as those utilizing direct or indirect syscalls, to bypass userland security hooks.
Detects lateral movement patterns associated with PsExec or its variants. The rule correlates SMB administrative share access (ADMIN$ or IPC$), the subsequent installation of a service (often named PSEXESVC or using a temporary executable path), and the immediate execution of a command or shell (cmd.exe or powershell.exe) by that service.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects NTLM network logons (LogonType 3 or 9) which often result from a host resolving an attacker-supplied UNC path (e.g., \host
esource) during forced authentication attacks. This rule monitors Windows Security Event ID 4624 to identify incoming NTLM-based network authentication requests, excluding local system logons.
Page 96 of 1908