Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,847 detections
Filters
Last updated
All Time
Detection languages
5,637
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
9,745
2,545
1,173
276
100
Products / Services
3,075
2,985
2,353
1,065
955
MITRE Techniques
6,780
3,901
2,671
2,015
1,829
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects the use of native Windows binaries such as vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe to inhibit system recovery by deleting shadow copies, clearing backup catalogs, or disabling automatic system recovery.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from non-reputable/non-Microsoft sources to suspicious directories such as Temp, AppData, or ProgramData, which is a common technique for ingress tool transfer during malware delivery.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from non-reputable/non-Microsoft sources to suspicious directories such as Temp, AppData, or ProgramData, which is a common technique for ingress tool transfer during malware delivery.
Detects the execution of the 'sckit' Go-based implant when spawned by Node.js or Python processes using the command-line arguments 'stage0 --config64'. This pattern is associated with malicious npm and PyPI supply chain packages (memtensor) designed to harvest credentials and establish persistence.
Detects malicious BASH_ENV injection within GitHub Actions CI pipelines originating from the compromised sckit_poetry_build.py build backend. The injection, which targets GITHUB_ENV to introduce a malicious _pypi_bridge.sh script, is used to intercept PyPI publishing tokens during build processes, characteristic of the MemTensor/sckit supply chain attack.
Detects the installation of known malicious npm or PyPI packages followed within 30 minutes by the execution of a package manager (node or python) performing network activity. This pattern matches the behavior of downloader stages in the 'Graphalgo' campaign, which uses coding-task lures to trick users into installing malicious packages.
Detects the creation of suspicious scheduled tasks using the Windows schtasks.exe utility. The rule flags tasks that are configured to run as SYSTEM, include PowerShell encoded commands, or target directories commonly used for persistence such as Temp, AppData, or Public.
Detects the abuse of Windows Management Instrumentation (WMI) to execute processes via wmic.exe or WmiPrvSE.exe, often combined with obfuscated command-line arguments such as encoded PowerShell or CMD commands.
Detects user-initiated execution of scripts or binaries directly from the root of a drive letter. This pattern is commonly associated with phishing campaigns delivering malicious payloads via mounted ISO or IMG files, which allow attackers to bypass mark-of-the-web or macro security controls.
Detects user-initiated execution of scripts or binaries directly from the root of a drive letter. This pattern is commonly associated with phishing campaigns delivering malicious payloads via mounted ISO or IMG files, which allow attackers to bypass mark-of-the-web or macro security controls.
Detects a Go toolchain process (go.exe) spawning potentially suspicious child processes such as secondary 'go run' commands or Node.js execution. This behavior is indicative of a malicious Go module executing embedded or decrypted code during the build process, a tactic seen in supply chain attacks targeting development environments.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs to sensitive or common staging directories (Temp, AppData, ProgramData). Attackers frequently abuse these built-in tools for 'living off the land' (LotL) to retrieve malicious payloads or secondary tools while bypassing traditional signature-based detection.
Detects the execution of msbuild.exe targeting project files (.csproj, .proj, .xml) located in user-writable directories such as Temp or Downloads, or containing command-line indicators of inline C# task execution (e.g., UsingTask, CodeTaskFactory). This behavior is commonly used for proxy execution and bypassing application allow-listing via LOLBAS.
Detects the creation of scheduled tasks (via Event ID 4698 or schtasks.exe) involving suspicious action paths, encoded PowerShell commands, LOLBins, or tasks configured to run as SYSTEM by non-administrator users, which is a common persistence mechanism for malware.
Detects lateral movement techniques leveraging Windows Management Instrumentation (WMI). The rule identifies instances where the WMI provider host, WmiPrvSE.exe, spawns common administrative or interactive shell tools (e.g., cmd.exe, powershell.exe). This pattern is consistent with the abuse of Win32_Process.Create() via WMI/DCOM/RPC for remote command execution, a method frequently utilized by frameworks like Impacket (wmiexec.py) for fileless, agentless lateral movement.
This rule detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to perform actions associated with ransomware, such as deleting volume shadow copies, deleting the backup catalog, or disabling system recovery features. This is a common precursor to data encryption to prevent the user from restoring files.
Detects the abuse of signed Windows system binaries (LOLBins: certutil, mshta, regsvr32, rundll32, bitsadmin, msiexec) through the identification of command-line arguments that suggest malicious activity, such as downloading remote content, decoding files, executing scriptlets, or loading DLLs from temporary storage directories.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of PowerShell with encoded commands (e.g., -EncodedCommand or -enc) combined with common download cradle indicators such as IEX, Net.WebClient, or DownloadString. This combination is highly indicative of fileless malware execution, initial access payload staging, or defense evasion techniques often employed by threat actors to bypass command-line monitoring.
Detects the abuse of the built-in Windows utility 'certutil.exe' to download remote files using URL cache functionality or to deobfuscate base64-encoded payloads. This is a common LOLBin (Living-off-the-Land Binary) technique used in phishing loaders, malware delivery, and post-exploitation toolkits.
Detects the creation of WMI permanent event subscriptions, including the instantiation of __EventFilter, __EventConsumer, and __FilterToConsumerBinding classes. This mechanism is frequently used by adversaries for fileless and reboot-resilient persistence, as it allows for arbitrary code execution triggered by system events.
Page 51 of 565