Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects PowerShell commands or script blocks that enumerate running processes and query WMI/CIM classes (such as Win32_ComputerSystem or Win32_BIOS) to identify indicators of virtualization, sandboxing, or the presence of security analysis tools. This behavior is indicative of anti-analysis and sandbox-evasion techniques, commonly used by threat actors like Kimsuky to verify their execution environment before proceeding with malicious activity.
This rule detects unauthorized persistence attempts by monitoring for the creation of a registry value named 'DailyFitnessTracker' under the HKEY_CURRENT_USER Run key. It triggers when 'reg.exe' is used to add the key, PowerShell is used to set the registry property, or when a general registry event indicates the creation of this specific key. This behavior is indicative of a persistence mechanism designed to launch a potentially malicious or unwanted program upon user logon.
Detects the creation of suspicious scheduled tasks using either schtasks.exe or PowerShell's Register-ScheduledTask cmdlet. The rule specifically looks for masquerading attempts involving names like 'StandAloneOneDriveUpdater-2626', the usage of AtLogOn triggers, and the execution of the binary 'Automata-20.exe'.
Detects the execution of a scheduled task named 'MicrosoftEdgeUpdateTaskUserS-1-5-24' which triggers conhost.exe with the --headless argument or PowerShell with an EncodedCommand. This behavior is indicative of a malicious persistence mechanism masquerading as a legitimate Edge update task, specifically associated with the retrieval of payloads from the malicious domain 'indiatodays.org'.
Detects the use of PowerShell to enumerate system disks, volumes, and partitions, specifically targeting removable media identifiers. This behavior is commonly associated with reconnaissance activities where an adversary attempts to identify attached storage devices for potential data staging or exfiltration.
Detects modifications to the Windows Registry 'Run' key or execution of commands via reg.exe or PowerShell that attempt to create or modify a persistence entry named 'DailyFitnessTracker'. This technique is commonly used by malware to ensure execution upon user logon.
This rule detects potentially malicious command patterns involving PowerShell and the Windows Task Scheduler. It identifies suspicious uses of Microsoft Edge update task names, PowerShell commands executing encoded scripts, and specific external download patterns associated with potential dropper or downloader activity.
Detects persistence mechanisms used by a Golang RAT, specifically targeting the creation of a 'DailyFitnessTracker' registry value in the HKCU Run key using reg.exe or PowerShell, and the placement of 'FitnessMonitor.exe' into the Windows Startup folder.
Detects execution of APT36's RUSTYSHADE backdoor, typically delivered via a DriverInstaller executable or zip file, and specifically tracks downloads from Backblaze B2 storage buckets using PowerShell.
Detects the establishment of persistence by the RUSTYMOVE malware through the creation of a scheduled task via PowerShell. The rule specifically looks for a command line containing both 'Register-ScheduledTask' and the specific masqueraded name 'StandAloneOneDriveUpdater-2626', which mimics a legitimate OneDrive update process.
Detects the execution of PowerShell commands by the RUSTYMOVE tool intended to enumerate external removable storage devices (USB, SD, MMC, IEEE1394). The rule monitors for the concurrent use of Get-Volume, Get-Partition, and Get-Disk cmdlets with specific BusType filtering patterns.
Detects malicious scheduled task creation using names intended to mimic Microsoft Edge update tasks. The rule identifies suspicious process activity including the spawning of conhost.exe with headless flags, PowerShell commands with encoded arguments, and attempts to fetch external scripts from the known malicious typosquatted domain indiatodays.org, all of which are characteristic of APT36 (Transparent Tribe) activity.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
Detects the use of obfuscated PowerShell commands that utilize .NET [Convert]::FromBase64String combined with character replacement string manipulation, a common technique to hide malicious payloads from simple static analysis.
Detects obfuscated PowerShell commands that utilize XOR operations combined with byte array manipulation and common file writing methods. This pattern is frequently used by malicious scripts to deobfuscate and drop payloads to disk.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
Detects the execution of PowerShell with common obfuscation flags (-W Hidden, -nop, -nol) that attempt to load and execute a script directly from the user's local Temp directory. The detection specifically monitors for processes launched by command interpreters like cmd.exe or batch files, which is a common indicator of a malware dropper or stager.
Detects suspicious execution of files located in the AppData Local Temp directory initiated by PowerShell or using PowerShell-specific hidden window arguments. This behavior is commonly associated with dropper scripts or malware staging execution from a user's temporary folder.
Page 40 of 160