Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
Detects the execution of PowerShell commands commonly used for host reconnaissance (e.g., whoami, ipconfig, net group, systeminfo) combined with the use of PowerShell to perform an HTTP POST request to a suspicious external IP address (202.182.102.5), suggesting post-compromise reconnaissance data exfiltration.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects the execution of PowerShell with a Base64-encoded command line originating from Windows Explorer, a behavior consistent with the Potemkin Loader and ClickFix attack campaigns used to bypass string-based detection.
Detects the abuse of GitLab Runner to establish a C2 channel via malicious PowerShell script blocks. The rule identifies anomalous combinations of GitLab CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none, CI_JOB_NAME=run_command) and the execution of arbitrary commands (IEX $env:CMD) within PowerShell script block logging (Event ID 4104).
Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.
Detects a host performing multiple distinct network reconnaissance commands in a short period, which is indicative of an attacker profiling the network configuration and environment of a compromised system.
Detects execution of virtualization-related tools and PowerShell cmdlets (New-VM, New-VHD) indicative of hypervisor management activities on Windows hosts. The rule monitors for processes such as vmconnect.exe, vmrun.exe, vmware.exe, and vmwp.exe, or specific PowerShell commands, excluding activity initiated by system-level accounts.
This rule detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe) or mshta.exe spawn shell processes (powershell.exe, pwsh.exe, cmd.exe) with suspicious command-line arguments. These arguments often indicate malicious activity such as downloading and executing code, using encoded commands, or hiding the execution window, which are typical indicators of a web-based delivery or exploitation attempt.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
Page 70 of 160