Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell commands that utilize base64-encoded strings, window style arguments for obfuscation, and subsequent decoding to reveal suspicious indicators such as network downloading commands or archive manipulation, indicative of potential fileless malware staging.
Detects a suspicious sequence of activities where PowerShell downloads or extracts specific zip files (node.zip, build.zip) to staging directories, followed by the execution of associated binaries like node.exe, winpty-agent.exe, or winpty.dll from those same locations. This behavior is indicative of an adversary staging and executing tooling within temporary user directories.
Detects Node.js or related helper processes executing shell commands (cmd.exe, powershell.exe) or other processes where the execution involves the 'withCreateProcessUser' argument. This often indicates attempts to bypass execution restrictions or run malicious payloads by utilizing Node.js as an execution proxy within unconventional or temporary directories.
Detects instances where OpenVPN service binaries (openvpn.exe or openvpnserv.exe) spawn command-line interpreters (cmd.exe or powershell.exe) with suspicious command-line characters or potentially unbalanced quotes. This behavior may indicate an attempt to leverage OpenVPN for code execution or persistence, often seen in environments where VPN configurations are manipulated to run arbitrary scripts.
Detects instances where OpenVPN service binaries (openvpn.exe or openvpnserv.exe) spawn command-line interpreters (cmd.exe or powershell.exe) with suspicious command-line characters or potentially unbalanced quotes. This behavior may indicate an attempt to leverage OpenVPN for code execution or persistence, often seen in environments where VPN configurations are manipulated to run arbitrary scripts.
Detects instances where OpenVPN service binaries (openvpn.exe or openvpnserv.exe) spawn command-line interpreters (cmd.exe or powershell.exe) with suspicious command-line characters or potentially unbalanced quotes. This behavior may indicate an attempt to leverage OpenVPN for code execution or persistence, often seen in environments where VPN configurations are manipulated to run arbitrary scripts.
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information
Detects execution of PowerShell.exe initiated by cplsupport.exe with hidden window styles and non-interactive, no-profile flags, which is often indicative of obfuscated command execution or malicious script activity.
Detects the installation of RustDesk or Cloudflared as a persistent Windows service, initiated by a PowerShell script. This behavior is indicative of unauthorized use of remote access or tunneling tools, often observed in intrusion activity such as Bumblebee, AdaptixC2, or Akira ransomware to facilitate persistence and establish reverse tunnels through firewalls.
Detects the execution of PowerShell with obfuscated parameters such as '-WindowStyle Hidden' and '-ExecutionPolicy Bypass' in combination with network-related cmdlets (Invoke-WebRequest) or process manipulation (Start-Process). It also checks for references to common temporary file paths or 'main.exe', often indicative of malicious script execution or payload staging. The rule also includes a filter to identify if the process was initiated by common WSL or Node.js related processes.
Adversaries may create a domain account to maintain access to victim systems.
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
Office add-ins can be used to add functionality to Office programs
Office add-ins can be used to add functionality to Office programs
Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
This rule detects when PowerShell is used to create or modify a LNK file within the Windows Startup folder. Adversaries often place malicious LNK files in this directory to achieve persistence, ensuring their code executes upon user login.
Detects instances of PowerShell being launched directly by explorer.exe with command-line arguments indicative of malicious activity, specifically the 'ClickFix' pattern where users are social-engineered to copy/paste malicious commands into the Windows Run dialog.
Detects suspicious execution of 'browsercore.exe' using common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern monitors for specific command-line arguments involving file redirection, content retrieval, or process spawning, which are often indicative of malicious activity or attempts to bypass security controls by leveraging legitimate-looking browser-related binaries.
This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.
Detects a PowerShell in-memory loader pattern that derives an AES key using Rfc2898DeriveBytes, decrypts an encrypted payload using System.Security.Cryptography.Aes, verifies the content with SHA256, and executes the decrypted code in-memory via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass file-based security controls by executing stage-two payloads directly in memory.
Page 50 of 160