Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the execution of processes where the command line contains suspicious obfuscated substrings. These substrings, which include segments like 'inASISFHfo', 'geASISFHutarvs', 'scASISFHuren', 'fiASISFHu_lsz', 'afASISFHile', or 'ruASISFHunf', are characteristic of command-line obfuscation techniques designed to bypass security monitoring by concealing the true intent of the command.
Detects the unknown or suspicious process 'doxc' (or 'doxc.exe') executing common Windows system administration utilities ('wmic.exe', 'fsutil.exe', 'cmd.exe') or command-line arguments typically used for reconnaissance and system information discovery, such as listing logical disks or volume information.
Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
Detects common Windows command-line utilities used for internal network reconnaissance, including ARP cache queries, NetBIOS enumeration, SMB share/session discovery, and subnet ping sweeps. These techniques are frequently employed by adversaries for lateral movement preparation and internal network mapping.
Detects the use of PowerShell to enumerate storage devices (USB, disk, partition information) and perform file operations such as copying or logging, potentially indicating malicious data collection from removable media or external drives.
Detects execution of command lines containing suspicious, potentially obfuscated substrings that do not correspond to standard Windows utilities. The use of custom delimiters like 'ASISFH' within common command strings suggests an attempt to bypass signature-based detection.
Detects a scenario where a process (cmd.exe) executing a file named 'config.bat' subsequently launches another instance of cmd.exe to delete files with a '.lnk' extension. This behavior is indicative of cleanup activities after potential malicious script execution.
This rule detects the execution of processes identified as 'DriverInstaller.exe' or files with known malicious SHA256 hashes associated with suspicious driver installation activity. The rule excludes legitimate system processes like msiexec.exe and trustedinstaller.exe, which are typically responsible for authorized software and driver installations.
Detects the execution of PowerShell with encoded commands in headless mode, associated with the Microsoft Edge Update Task (MicrosoftEdgeUpdateTaskUserS-1-5-24). This pattern is indicative of potential malicious activity where legitimate update tasks are abused to run obfuscated scripts.
Detects instances where the process 'UBPUpdater.Exe' spawns a process or command line utilizing 'UBPPatch.Psh'. The rule highlights that 'UBPPatch.Psh' is masquerading as a non-executable PowerShell script while likely operating as a malicious binary or PowerShell executable.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
This rule detects potential lateral movement activity involving the use of the 'net use' command to connect to remote IPC$ shares or administrative tools like 'Test-NetConnection' to probe for SMB and RPC ports (445/135). Such techniques are often used by threat actors like APT36 to verify network connectivity and establish authenticated sessions for lateral movement.
Detects the execution of command-line operations that involve the deletion of shortcut (.lnk) files or the self-deletion of batch scripts, often used by malware or malicious scripts to minimize their footprint and remove evidence after execution.
Detects instances where Windows Explorer (explorer.exe) spawns cmd.exe or wscript.exe to execute batch files (.bat) or scripts with specific filenames. This behavior is often associated with malicious user activity, such as executing payloads disguised as innocuous files triggered via shell interactions.
This rule detects the execution of 'DriverInstaller.exe' (either by filename or a known malicious SHA256 hash) that subsequently initiates network connections to GitHub domains. This behavior is indicative of potential malicious activity, such as downloading secondary payloads, command-and-control communication, or beaconing from a suspected rogue or masquerading driver installation utility.
Detects the creation of scheduled tasks using either 'schtasks.exe' or 'powershell.exe' (Register-ScheduledTask) where the task name or configuration references common update or startup task patterns, or contains indicators of potential process hiding or encoded command execution.
Page 154 of 977