Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects Active Directory enumeration consistent with BloodHound/SharpHound collection: SharpHound.exe or PowerView cmdlet process/command-line signatures, matching PowerShell script block log content, and bursts of LDAP traffic (ports 389/636) from a single source to a domain controller.
Detects lateral movement patterns associated with PsExec or its variants. The rule correlates SMB administrative share access (ADMIN$ or IPC$), the subsequent installation of a service (often named PSEXESVC or using a temporary executable path), and the immediate execution of a command or shell (cmd.exe or powershell.exe) by that service.
Detects the use of PowerShell to download content from a remote URI and execute it using encoded commands or expression evaluation, a pattern commonly used by the FIN8 threat group (Syssphinx) to deploy the BADHATCH backdoor.
This rule detects instances where Microsoft Word (winword.exe) or Microsoft Excel (excel.exe) initiate a PowerShell (powershell.exe) process containing command-line arguments typical of downloader stagers, such as 'IEX', 'DownloadString', or hidden execution flags. This behavior is a common indicator of macro-based delivery of malware, frequently observed in campaigns associated with FIN7/Carbanak and other threat actors utilizing Cobalt Strike or similar offensive frameworks.
Detects the Antino backdoor components (GatherOsState.exe or a standalone installer) spawning cmd.exe or powershell.exe to execute commands, indicative of command-and-control tasking.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
This rule detects potential malicious activity where a file (in this case, a PDF) is downloaded using curl via conhost, followed shortly by a PowerShell command that searches the file for a specific marker ("cAB") and decodes/executes embedded Base64 content. This pattern aligns with known TTPs observed in Star Blizzard (COLDRIVER) campaigns.
This rule detects potentially malicious PowerShell command execution originating from a Windows Remote Management (WinRM) process (wsmprovhost.exe). It monitors for child processes of wsmprovhost.exe launching powershell.exe or pwsh.exe combined with indicators of obfuscated command-line arguments, such as encoded commands, base64 strings, or common bypass/evasion parameters like IEX or -NoProfile.
Detects a suspected ClickFix-style delivery mechanism where a user visits suspicious domains mimicking legitimate CLI tools (e.g., Gemini, Claude) via web browsers. The detection correlates this initial network access with subsequent suspicious Windows RunMRU activity and the spawning of shell processes (powershell.exe, cmd.exe) from explorer.exe using encoded or download-oriented command line arguments within a 5-minute window.
Detects the execution of PowerShell from processes associated with legitimate Remote Monitoring and Management (RMM) tools (such as ScreenConnect or LogMeIn) running under the SYSTEM account. This behavior is indicative of an attacker who has gained access to an RMM tenant and is using an interactive session to execute commands, perform reconnaissance, or deploy further malicious payloads.
Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
Detects the execution of PowerShell commands that reflectively load .NET assemblies into memory, followed immediately by a process injection event targeting Chromium-based browsers (e.g., chrome.exe) or Firefox. This behavior is highly characteristic of credential harvesting tools like BoundSiphon, which injects code into browser processes to decrypt and extract App-Bound encryption keys.
This rule detects suspicious PowerShell command-line activity that uses '-ExecutionPolicy Bypass' in conjunction with network-fetching cmdlets like 'Invoke-RestMethod' or 'irm' to download files to a temporary directory, followed by potential script execution. This pattern is commonly used by adversaries for stage-1 payload delivery and fileless execution.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
Detects the mounting of VHDX files via disk imaging tools or PowerShell, followed shortly (within 15 minutes) by the execution of a shell process with hidden window flags. This behavioral pattern is associated with the delivery of malicious payloads, such as those observed in Star Blizzard's RedFlick delivery chain for CosmicPulse.
Detects multiple methods of tampering with Windows Defender security controls within a short time window. This includes PowerShell commands to modify Defender preferences (e.g., disabling Real-time Monitoring or adding exclusions), modifications to Defender-related registry keys, and attempts to stop or disable the WinDefend service.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects suspicious execution of command-line utilities (cmd.exe, powershell.exe, conhost.exe) directly from Windows Explorer (explorer.exe), which is often indicative of fileless malware execution, downloader activity, or 'ClickFix' style social engineering attacks.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
This rule detects persistence mechanisms by monitoring additions to Windows Registry Run keys or files created in the user's Startup directory. It specifically flags entries that target suspicious locations (e.g., Temp, AppData, Public) or attempt to execute encoded commands using PowerShell or CMD.
Page 9 of 160