Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects the use of PowerShell commands to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) on web application directories and configuration files, a technique often used by attackers to hide modifications made to webshells or malicious scripts.
Detects PowerShell execution that modifies the 'jquery.mousewheel-3.0.6.pack.js' file while simultaneously attempting to timestomp file metadata or utilizing specific obfuscation markers identified in webshell deployment patterns.
Detects a multi-stage activity where PowerShell is used to download a ZIP file, followed by the execution of a batch script (1.bat) that subsequently launches LockScreenContentServer.exe. This behavior is indicative of a DLL side-loading chain designed to execute malicious code via legitimate processes.
This rule detects instances where a process matching a known sideload-vulnerable binary (such as werfaultsecure or wuauclt) spawns a PowerShell process that executes commands commonly used for Active Directory reconnaissance and system information discovery. This behavior is indicative of post-compromise activity, specifically reconnaissance phases performed by malware loaders like Lorem Ipsum.
Detects the insertion of a PowerShell download cradle command into the Windows Explorer RunMRU registry key. This activity is indicative of the 'ClickFix' technique, where a user is socially engineered to copy and paste a malicious command into the Windows Run dialog box.
Detects the 'ClickFix' social engineering pattern where a user is instructed to copy and paste a malicious command into the Windows Run dialog. The rule triggers on PowerShell being launched from explorer.exe with 'ExecutionPolicy Bypass', utilizing 'irm' (Invoke-RestMethod) to download content, and saving it to the user's TEMP directory via 'Out-File' for subsequent execution.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
This rule detects PowerShell processes initiated with command-line arguments that indicate obfuscation (e.g., -enc, -encodedCommand) or attempts to download or execute external content (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is commonly observed during the initial execution of malicious payloads or tool delivery.
Detects the use of common PowerShell techniques designed to bypass the Antimalware Scan Interface (AMSI). These techniques involve manipulating internal PowerShell objects like AmsiUtils or amsiInitFailed, or using reflection to locate and modify AMSI memory structures to disable scanning.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, powershell, diskshadow) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware operations intended to inhibit system recovery.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects anomalous process execution (cmd.exe, powershell.exe, wmic.exe, tasklist.exe, taskkill.exe) initiated by the process 'ReportDump.exe'. This activity is indicative of the SectopRAT payload performing remote shell, file management, or process control tasks initiated via a C2 channel.
Detects the abuse of the CMSTPLUA COM object, a known technique for UAC bypass, to execute a hidden and non-profile PowerShell process. This behavior is associated with malicious activity chains like RemotePanel or BoundSiphon that aim to achieve elevated execution.
Detects reconnaissance activity on IIS servers where the worker process (w3wp.exe) spawns appcmd.exe or PowerShell to list websites, virtual directories, or application pools. This pattern is indicative of an attacker performing post-exploitation discovery after establishing a web shell.
Page 7 of 160