Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where PowerShell is executed with an explorer.exe parent process, but the actual creating process differs from explorer.exe. This behavior is indicative of parent PID (PPID) spoofing, a technique often used to evade detection or masquerade the execution source by abusing the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS flag in the Windows API.
Detects the suspicious execution of ServiceModelReg.exe or command lines containing the 'Elevation:Administrator!new:' string, which is associated with bypasses of Windows User Account Control (UAC). The rule excludes trusted system processes like msiexec, TrustedInstaller, and svchost to reduce noise.
Detects the execution of IronPython or generic Python interpreters where the command line contains suspicious obfuscation patterns, including base64-encoded strings, zlib compression/decompression, and the use of the subprocess module. This pattern is commonly used by adversaries to execute hidden or obfuscated malicious payloads.
This rule monitors process creation, file system activity, and HTTP logs for indicators associated with the 'GHOST-VAULT' or 'GHOST-CRED' threat activity. It specifically triggers on files or paths containing 'GHOST-VAULT-', processes named 'ghost_' or containing 'ghost_' in the command line, and HTTP requests containing 'GHOST-CRED/3.0', 'GHOST-VAULT/', or 'GHOST/0day'.
Detects the execution of processes that contain command-line arguments indicative of debugger evasion techniques, such as checking for the presence of a debugger using functions like 'IsDebuggerPresent' or 'CheckRemoteDebuggerPresent'. This is commonly associated with malware attempting to evade dynamic analysis in sandboxes or by security researchers.
Detects execution of the Windows diskpart utility using a script file, initiated by a process with a name ending in _win64.exe. This pattern is commonly used in malicious scripts for disk manipulation or inhibiting system recovery.
Detects instances where AI-assisted coding tools (such as Claude, Copilot, or Gemini) initiate Git operations (clone, checkout, fetch) in a non-interactive context. This behavior may indicate an automated process using AI tools to perform code repository interactions that should typically be user-initiated or are otherwise suspicious in a non-interactive environment.
Detects execution of PowerShell or Command Prompt where the command line contains obfuscated indicators or specific suspicious files and IP addresses, while simultaneously bypassing the execution policy. This is characteristic of malicious script execution or payload delivery attempts.
Detects execution of PowerShell or CMD commands originating from Windows Explorer (explorer.exe) that exhibit characteristics of malicious command-line obfuscation, such as encoded commands, bypass flags, or caret-based character obfuscation.
Detects the execution of ReAgentC.exe with the /disable flag, which disables the Windows Recovery Environment (WinRE). This activity is often used by adversaries to prevent system recovery or to facilitate data impact, such as ransomware deployment.
Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.
Detects the execution of git checkout commands initiated by known AI-powered coding assistants or CLI tools. This behavior may indicate an AI agent or automated script interacting with source code repositories in an unexpected or potentially unauthorized manner.
This rule detects potentially suspicious Git checkout operations initiated by AI coding assistant processes (such as Copilot, Claude, or Gemini). It looks for cases where these assistants execute a 'git checkout' command containing a specific commit hash (40 characters), followed by a secondary event where the git output indicates an 'ambiguous refname' error. This pattern may suggest an attempt by an AI tool to manipulate repository state or checkout arbitrary objects, potentially related to unauthorized code injection or malicious repository interaction.
Detects command-line activity indicating an attempt to bypass or tamper with Anti-Malware Scan Interface (AMSI) functionality. The rule flags processes invoking GetProcAddress or LoadLibrary to resolve and manipulate AMSI-specific functions like AmsiScanBuffer or AmsiScanString within amsi.dll, a common technique for disabling runtime script scanning.
Detects the execution of wscript.exe with silent (/B) and no-logo (/Nologo) flags, spawned by a process named MicrosoftEdgeUpdateTaskCore. This pattern is indicative of potential living-off-the-land techniques where an adversary leverages a legitimate system task to execute scripts stealthily.
Detects execution of PowerShell spawned by wscript.exe or cscript.exe attempting to retrieve a process-level environment variable named 'Kv[0-9]+'. This pattern is associated with 'LausivLoader', which uses environment variables to pass file paths or malicious payloads between a legacy script host and PowerShell. The rule optionally tracks attempts to delete associated files after the handoff.
Detects the spawning of a hidden PowerShell process by wscript.exe via conhost.exe with the --headless argument. This pattern is characteristic of the LausivLoader malware, which utilizes obfuscated command-line arguments to execute hidden PowerShell scripts.
Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.
Detects execution of PowerShell commands containing indicators of in-memory AMSI (Antimalware Scan Interface) patching, specifically referencing AmsiScanBuffer, AmsiScanString, or AmsiOpenSession in conjunction with amsi.dll. This behavior is associated with the initialization stage of LausivLoader prior to its payload retrieval phase.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Page 152 of 977