Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,842 detections
Filters
Last updated
All Time
Detection languages
5,632
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,459
11,842
5,879
5,158
4,866
Platforms
9,740
2,545
1,173
276
100
Products / Services
3,075
2,981
2,352
1,065
955
MITRE Techniques
6,779
3,901
2,671
2,015
1,827
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
Detects the execution of the DEL command via cmd.exe spawned by sqlservr.exe, specifically targeting batch scripts, executables, or text files located within AppData or ServiceProfiles paths. This behavior is indicative of post-exploitation activity where an attacker removes staging artifacts used during lateral movement or persistence phases to hide their tracks after using xp_cmdshell.
This rule detects instances where the SQL Server process (sqlservr.exe) spawns cmd.exe or powershell.exe as child processes. This behavior is strongly associated with the abuse of the 'xp_cmdshell' stored procedure, which allows SQL Server to execute operating system commands. This is a common post-exploitation technique used by attackers to execute commands or scripts following successful unauthorized access or brute-force attacks on MSSQL instances.
Detects post-compromise activity associated with the NeedyMantis group, specifically the staging of a legitimate binary alongside a malicious DLL and a paired archive, followed by the execution of the legitimate binary to trigger DLL side-loading. This activity is typically preceded by Impacket-style remote command execution (e.g., wmiexec, smbexec, atexec).
Detects Android malware attempting to abuse accessibility services or system settings to enable wireless debugging and spawn an ADB shell with elevated privileges. This behavior is indicative of unauthorized control over the device via Android Debug Bridge (ADB).
Detects specific HTTP traffic patterns associated with the RatHat malware's FRP (Fast Reverse Proxy) reverse-tunneling deployment and C2 status reporting. The rule identifies the sequence of fetching configuration, initiating WebSocket tunnel links, and reporting deployment status to a remote command-and-control server.
Detects execution of various reconnaissance commands commonly used by Remote Access Trojans (RATs) to profile a target host. This includes querying security product status (AV/Defender), enumerating domain controllers, network adapters, port scanning, and gathering system hardware and software inventory.
This rule detects the execution of 'netstat.exe' when initiated by a Python process (python.exe, python3.exe, or pythonw.exe) where the executable is located in non-standard, likely project-specific or virtual environment directories (e.g., 'Scripts', 'bin', 'venv', 'site-packages'). This pattern is often used to execute system binaries from unconventional locations to evade detection or as part of a post-exploitation activity where a script or package includes a malicious or hijacked version of a legitimate system tool.
Detects suspicious command execution patterns (such as PowerShell encoded commands, IEX, or cmd.exe) being stored or accessed within the Windows Registry 'TypedPaths' key, which is used by Windows Explorer to track recently accessed paths. Adversaries may attempt to use this location to execute payloads via user-triggered interactions.
Detects a suspicious command-line chain where 'cmdkey' is used to add credentials, followed by the execution of 'regsvr32' targeting a DLL file hosted on a remote UNC path. This pattern is commonly associated with ClickFix or FileFix techniques where an adversary attempts to force authentication and execute malicious code via proxy execution.
Detects instances where Windows Explorer launches command interpreters (cmd.exe, powershell.exe, wscript.exe, or mshta.exe) with suspicious leading whitespace in the command-line arguments. This behavior is often associated with obfuscation techniques intended to bypass command-line monitoring or security filters.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task configuration is fetched from a remote XML file (HTTP/HTTPS URL). This pattern is often used by adversaries to download and execute malicious payloads via task scheduling, bypassing local file restrictions.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
Detects the execution of bash commands that contain base64 decoding flags, typically used to obfuscate command-line arguments to evade detection, initiated from a terminal application.
Detects suspicious execution patterns on macOS where the Terminal application launches a bash process executing base64-encoded commands. This behavior is indicative of the ClickFix campaign, where users are prompted to copy and paste malicious obfuscated scripts into the terminal, often under the guise of a reCAPTCHA verification.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects anomalous behavior where a node.exe process establishes an outbound network connection, characteristic of a C2 registration or ping loop, followed shortly by the spawning of an interactive command shell (cmd.exe or powershell.exe) by the same node.exe process. This pattern is indicative of a RAT (Remote Access Trojan) shell handler execution.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Page 37 of 564