Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Detects attempts to impair or disable Microsoft Defender Antivirus through unauthorized exclusion paths, Registry modifications, tampering with protection settings, or forcing policy updates.
Detects the creation of scheduled tasks using schtasks.exe or Event ID 4698, specifically filtering for tasks that execute PowerShell, WScript, or JavaScript files. This behavior is indicative of potential persistence mechanisms, such as those observed in the LausivLoader.
Detects the creation of Windows scheduled tasks using schtasks.exe that exhibit high-risk indicators, such as targeting temporary or user-writable directories (Temp, AppData), setting high-privilege execution flags, or utilizing PowerShell with encoded payloads. These behaviors are commonly associated with the installation of persistence mechanisms by threat actors.
Detects the execution of known privilege escalation tools and the use of specific Windows privilege keywords (such as SeImpersonatePrivilege) often associated with access token manipulation and token impersonation attacks to elevate privileges to SYSTEM.
Detects instances where rundll32.exe is executed with suspicious command-line parameters that are often associated with malicious activity. This includes attempts to dump memory (comsvcs.dll), utilize specific protocols (url.dll), execute JavaScript, or leverage common writeable directories for payload staging, all of which are common techniques used by attackers to proxy execution and evade defenses.
Detects attempts to disable Windows Defender features via PowerShell, terminate critical security services using administrative tools like sc.exe or net.exe, or inject/patch AMSI (Antimalware Scan Interface) within a process context to evade detection.
Detects instances where the Terraform process initiates a 'go run' command or references specific Go-based provider source files, which may indicate an attempt to run malicious or unauthorized Go code within the infrastructure-as-code environment. This behavior is indicative of supply chain compromise where providers are leveraged to execute arbitrary logic.
Detects instances where explorer.exe (the Windows Shell) spawns a PowerShell process with suspicious flags, commonly associated with 'ClickFix' social engineering attacks where users are prompted to copy and paste malicious commands into the Windows Run dialog.
This rule detects Terraform CLI activity interacting with suspicious domains or modules, specifically targeting known repositories or namespaces (e.g., gocommunity.io, gogets.dev). It monitors for Terraform initialization or application patterns referencing these domains in process command lines, as well as the creation of Terraform provider files within these specific namespaces. This behavior is indicative of potential supply chain compromise involving malicious Terraform modules or dependencies.
Detects the execution of 'go' or 'go.exe' with 'run' commands originating from infrastructure automation or orchestration tools such as Terraform, Docker, or other related automation processes. This pattern may indicate the execution of arbitrary Go code or modules in environments where infrastructure code is being managed or deployed.
Detects the execution of terraform.exe or go.exe on developer hosts, which acts as a precursor to the malicious Terraform provider campaign (Graphalgo) that targets cloud credentials.
Detects execution of rundll32.exe and regsvr32.exe with command lines indicative of living-off-the-land techniques, including usage of remote scriptlets, URLs, JavaScript, and execution from non-standard system paths, which are often used for proxy execution or to bypass security controls.
Detects the execution of PowerShell with common obfuscation or download flags (e.g., -EncodedCommand, IEX, DownloadString) specifically when the parent process is a common attack vector entry point such as Office applications, web browsers, or script hosts (wscript/cscript/mshta). This behavior is characteristic of phishing-based execution chains.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin) or PowerShell cmdlets to delete Volume Shadow Copies or backup catalogs. This behavior is commonly associated with ransomware attempts to prevent system recovery.
This rule detects potential Windows token manipulation by correlating logon events containing sensitive privileges (SeDebugPrivilege/SeImpersonatePrivilege) with subsequent process creation events under a different user context within a short timeframe. It further validates the activity by incorporating Sysmon Event ID 10 alerts that identify process access patterns commonly associated with token duplication or impersonation techniques used in post-exploitation frameworks like Cobalt Strike.
Detects the creation of Windows scheduled tasks that include suspicious interpreters (PowerShell, cmd.exe, rundll32) or execution paths located in common attacker-writable directories (Temp, AppData, ProgramData), which is a common technique for persistence and command-and-control re-establishment.
Detects execution of PowerShell processes employing common obfuscation and evasion techniques frequently associated with fileless malware loaders and malicious script execution. This includes the use of EncodedCommand, Base64 strings, IEX/Invoke-Expression download cradles, and stealth execution flags (e.g., hidden windows combined with non-interactive modes).
Detects the execution of the rclone utility (including renamed binaries) using command-line arguments consistent with data exfiltration or synchronization (copy, sync, move) that is followed by network communication to known cloud storage providers commonly abused for staging and exfiltration in ransomware attacks.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that point to suspicious script execution, encoded commands, or files located in commonly abused writable directories like Temp or ProgramData. This behavior is indicative of potential persistence mechanisms.
Page 115 of 977