Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,839 detections
Filters
Last updated
All Time
Detection languages
5,629
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
9,739
2,542
1,172
276
100
Products / Services
3,075
2,979
2,352
1,065
955
MITRE Techniques
6,777
3,901
2,671
2,014
1,827
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects the execution of reconnaissance commands designed to enumerate Active Directory domain trust relationships. Attackers, including those associated with ransomware operations like INC Ransom, use these tools to map organizational structures and identify pathways for lateral movement and cross-domain propagation.
Detects the creation of scheduled tasks using schtasks.exe that exhibit behaviors associated with common remote execution tools (e.g., Impacket's atexec.py) or staging from insecure directories like Temp, ProgramData, or network shares. These patterns are frequently used by threat actors, including INC Ransom, for lateral movement and remote execution of malicious payloads.
Detects the use of legitimate Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to prevent automatic system recovery. This behavior is a common indicator of ransomware preparing for encryption by removing local recovery options.
Detects suspicious command line patterns on macOS where base64 encoded strings are decoded and piped directly into a shell interpreter (bash/zsh/sh). This pattern is commonly used by adversaries to execute obfuscated payloads or scripts directly in memory.
This rule detects installation of known malicious npm packages associated with the PhantomSub campaign, which abuse WhatsApp spam channels. It also identifies network connections to known remote C2 channel-list URLs or domains used by these packages to automate channel joining.
This rule detects installation of known malicious npm packages associated with the PhantomSub campaign, which abuse WhatsApp spam channels. It also identifies network connections to known remote C2 channel-list URLs or domains used by these packages to automate channel joining.
This rule detects installation of known malicious npm packages associated with the PhantomSub campaign, which abuse WhatsApp spam channels. It also identifies network connections to known remote C2 channel-list URLs or domains used by these packages to automate channel joining.
This rule detects installation of known malicious npm packages associated with the PhantomSub campaign, which abuse WhatsApp spam channels. It also identifies network connections to known remote C2 channel-list URLs or domains used by these packages to automate channel joining.
This rule detects potential post-exploitation activity following a SharePoint XamlServices.Parse() deserialization attack. It monitors the w3wp.exe (IIS worker process) for the loading of suspicious .NET deserialization-related assemblies (e.g., System.Xaml.dll) followed by the execution of a shell process (cmd.exe, powershell.exe, etc.) within a short window, which is indicative of fileless web shell activity.
Detects unauthorized mass clearing of Windows Event Logs using wevtutil or PowerShell cmdlets. This behavior is often observed in ransomware campaigns (e.g., Nova, Gentlemen) as an anti-forensic measure to hinder incident response and investigation by removing audit trails across significant log channels like Security, System, and PowerShell.
Detects activity associated with the SharePoint ToolShell exploitation chain, specifically monitoring the w3wp.exe process for spawning suspicious child processes like cmd.exe or powershell.exe, and the creation of unexpected .aspx files within the SharePoint LAYOUTS directory.
Detects the modification of service permissions for the 'AgtaBackupAgentSvc' service using the 'sdset' command via 'sc.exe', 'cmd.exe', or 'powershell.exe'. Adversaries use this technique to hide services or modify access to them by applying a specific Service Descriptor Definition Language (SDDL) string to bypass security enumeration or maintain persistence.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects the deletion of volume shadow copies using standard Windows utilities vssadmin.exe or wmic.exe. This activity is a common indicator of ransomware or other destructive attacks attempting to inhibit system recovery.
Detects execution of common Windows utilities used by adversaries post-encryption to hinder system recovery and clear forensic evidence. This includes disabling the Windows Recovery Environment (ReAgentC), wiping disk free space (Cipher), clearing DNS caches, and clearing Windows Event Logs via Wevtutil or PowerShell.
This rule detects potential malicious activity where a non-browser process downloads a specific payload file from a suspicious domain ('easyllms.xyz') and is subsequently linked to process activity involving the discovery of system or user information (e.g., GetComputerNameA, GetUserNameA). This pattern is characteristic of a dropper or stage-one malware attempting to profile the compromised host.
Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
Detects the 'ClickFix' social engineering pattern where an adversary tricks a user into using the Windows Run dialog (explorer.exe) to execute msiexec.exe, downloading and installing a remote MSI package. This is frequently associated with malware delivery, such as Psychedelic Stealer, where users are prompted to copy and paste malicious commands under the guise of fake error messages or CAPTCHAs.
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
Detects the execution of the DEL command via cmd.exe spawned by sqlservr.exe, specifically targeting batch scripts, executables, or text files located within AppData or ServiceProfiles paths. This behavior is indicative of post-exploitation activity where an attacker removes staging artifacts used during lateral movement or persistence phases to hide their tracks after using xp_cmdshell.
This rule detects instances where the SQL Server process (sqlservr.exe) spawns cmd.exe or powershell.exe as child processes. This behavior is strongly associated with the abuse of the 'xp_cmdshell' stored procedure, which allows SQL Server to execute operating system commands. This is a common post-exploitation technique used by attackers to execute commands or scripts following successful unauthorized access or brute-force attacks on MSSQL instances.
Page 36 of 564