Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of 'mshta.exe' loading an .hta file containing specific suspicious terms ('VLC', 'Presentation', 'Denver'), followed by the spawning of child processes such as 'wscript.exe', 'cscript.exe', 'powershell.exe', 'cmd.exe', or 'wmic.exe'. This pattern is frequently used to proxy execution of malicious scripts via legitimate Windows binaries.
Detects the execution of a specific Visual Basic script named 'Telegram_Private_Call_Session.vbs' by Windows scripting utilities (wscript.exe, cscript.exe) or the Microsoft HTML Application host (mshta.exe). This pattern is often associated with the execution of malicious scripts disguised as legitimate communication application components.
Detects the execution of PowerShell with obfuscation-related flags (-NoProfile, -WindowStyle Hidden, -EncodedCommand) initiated by common scripting interpreters (wscript.exe, mshta.exe, cscript.exe). This pattern is often indicative of malicious scripts, such as HTA or VBScript files, attempting to execute encoded PowerShell commands in a high-privilege context.
Detects the presence or execution of artifacts associated with the TrustSink proof-of-concept (deploy.py, cleanup_eam.py, deploy_state.json), which is used to register or remove rogue Entra authentication providers.
This rule detects the execution of common command-line or scripting tools (cmd.exe, powershell.exe, wscript.exe, cscript.exe, ftp.exe) or .lnk file handling triggered by explorer.exe immediately following the mounting of a VHD or VHDX file. This behavior is indicative of an attacker mounting a malicious virtual disk image and executing payloads contained within it.
Detects anomalous process spawning behavior initiated by Python interpreters (pip/conda) on machine learning developer or training hosts, which may indicate a supply chain compromise where a malicious package executes code during or shortly after installation.
This rule detects three distinct suspicious behaviors related to potential file manipulation and persistence mechanisms: 1. Use of 'copy /b' command to reconstruct files from fragments (e.g., header.doc, body.doc), commonly associated with file joining or data reconstruction. 2. File access within '_rels' directories targeting document fragments, often used in malicious document analysis or extraction. 3. Execution of 'Windowsupdate.exe' from the 'AppData\Local' directory, a technique often used for masquerading as a legitimate Windows service to establish persistence.
Detects the execution of the Windows FTP client (ftp.exe) using command-line arguments that include scripts (-s:), initiated by unconventional parent processes such as explorer.exe or cmd.exe. This behavior is often associated with the execution of automated FTP scripts for data exfiltration or malware delivery.
Detects a specific sandbox/analysis evasion pattern associated with the QUICAgent malware, which involves a tight hashing loop and a randomized 100-600ms delay occurring between process initiation and the first outbound network connection.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
This rule monitors for file and process creation events associated with known MD5 and SHA256 hashes linked to the Vidar infostealer malware.
This rule monitors for file and process creation events associated with known MD5 and SHA256 hashes linked to the Vidar infostealer malware.
This rule detects the use of xcopy.exe with a specific set of flags (/s, /e, /y, /c, /q, /h, /b) typically used for recursive, forced, and quiet file copying, when executed from a path matching 'C:\Users\Public\[A-Za-z0-9]+'. This behavior is often associated with adversaries staging data for exfiltration or moving lateral movement tools within a compromise directory.
Detects rapid execution of multiple discovery-related commands (whoami, tasklist, ipconfig, netstat, systeminfo) by common Windows host processes within a 15-minute window. This behavior often indicates an adversary performing reconnaissance after gaining an initial foothold.
This rule detects the loading of a driver named 'eb.sys' (or matching a specific SHA256 hash) paired with the creation of a Windows service for that driver via the 'sc' command. This behavior is indicative of potential rootkit installation or driver-based persistence mechanisms.
Detects execution of Windows Installer packages (MSI) masquerading as common software installers (Spotify, Zoom, Microsoft Teams) using known ChainScript-style naming patterns and suspicious command-line parameters (e.g., ALLUSERS=2, MSIINSTALLPERUSER=1) or invocation from common user-mode applications like cmd.exe, powershell.exe, or explorer.exe.
Detects the execution of processes or creation of events attempting to mimic Windows Security credential prompts. This pattern is characteristic of the TukTuk C2 framework's 'Cred Prompt' feature, designed to harvest user credentials by presenting a fake authentication dialog.
Detects potential anti-analysis or sandbox evasion behavior where a process checks for the existence of the Cursor IDE application using native system utilities like ps, pgrep, or lsof. This check is often used by malware (such as the FLATROOF/ROOFDECK backdoors) to gate beaconing activity by ensuring the execution environment is not an analysis sandbox.
Detects a suspicious execution chain where a browser process makes a network connection, followed shortly by a direct execution of command-line tools (powershell.exe, mshta.exe, or cmd.exe) from the Windows explorer.exe process (e.g., via the Run dialog). This behavior is characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and pasting malicious commands from a web page directly into their local environment.
Detects the use of the 'finger.exe' utility in a suspicious manner, indicative of payload staging in a 'ClickFix' phishing attack scenario. The rule monitors for instances where 'finger.exe' is executed with suspicious command-line arguments (containing '@' or '-l') by common parent processes associated with malicious copy-paste activities (cmd.exe, powershell.exe, or explorer.exe).
Page 124 of 977