Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of command interpreters or scripting engines spawned by the ManageEngine ADSelfService Plus GINA client process (typically present at the Windows logon screen). This activity is highly suspicious as it indicates potential command injection or abuse of a pre-authentication component running at SYSTEM privileges.
Detects instances where Outlook (OUTLOOK.EXE) spawns an executable named 'ai.exe' with a command line containing a 16+ character hexadecimal string, followed closely (within 10 minutes) by a Microsoft Edge (msedge.exe) process execution acting as a network utility. This pattern is indicative of a potential phishing-initiated attack where a malicious payload is executed and subsequently leverages browser components for network communication or C2 activity.
Detects the execution of ConfigurationRemotingServer.exe initiated by winget.exe. This could indicate usage of the Windows Package Manager to facilitate remote configuration or management tasks, which warrants investigation for potential unauthorized use or process manipulation.
This rule detects instances of MSBuild.exe executing or communicating over the network while referencing .NET Framework paths. MSBuild is often abused as a LOLBAS (Living Off the Land Binary and Script) to execute arbitrary code or bypass application control, and unusual network activity from this process is a common indicator of beaconing or command-and-control communication.
This rule detects the use of 'winget' or 'ConfigurationRemotingServer.exe' to execute Windows Configuration DSC (Desired State Configuration) files, specifically targeting the invocation of 'PSDscResources/Script' resources, 'SetScript', 'TestScript', or 'GetScript' operations. This technique may be leveraged by attackers to execute arbitrary code or maintain persistence through the configuration management framework.
Detects the use of the Windows 'tasklist' utility or command execution via 'cmd.exe' when the command line includes strings associated with common debugging tools (e.g., windbg, x64dbg). This behavior may indicate an adversary checking for the presence of analysis tools or attempting to manipulate running processes, which is often associated with debugger evasion or malicious environment reconnaissance.
Detects the execution of 'rundll32.exe' or 'dllhost.exe' with command-line arguments typically associated with loading Control Panel items (.cpl files). This behavior is often used by adversaries to proxy execution of malicious payloads or bypass security controls by leveraging legitimate Windows binaries.
Detects execution of PowerShell with bypassed execution policy used to download or copy files from remote locations using curl.exe and Copy-Item. This pattern is commonly associated with file staging or retrieving malicious payloads from external URLs, including specific paths.
This rule detects suspicious PowerShell activity including the use of PowerShell to invoke 'curl.exe' for data transfer or the creation of randomly named executables (6-10 characters) within the 'AppData\Local\Temp' directory, which is a common indicator of file staging or malware execution.
Detects execution of 'codeflush.exe' or attempts to rename files involving 'codeflush.exe' and 'pythonw.exe' within 'MusicLibrariesPackage' directories. This activity often indicates the execution of potentially malicious scripts or tools masquerading as legitimate software.
Detects instances where an executable masquerading as 'msedge.exe' (Microsoft Edge) is launched from a user's Startup folder. The rule looks for files identified as 'msedge.exe' that contain metadata or product information associated with DISM (Deployment Image Servicing and Management) or base Windows operating system components, indicating a potential attempt to disguise a different utility or payload as a trusted web browser.
Detects the creation of scheduled tasks using schtasks.exe that are configured to repeat every minute, specifically targeting known malicious or suspicious filenames such as 'MicrosoftUserInterfacePicturesUpdateTackMachine', 'userscreen.exe', or 'config.cat'. The rule monitors both process creation command lines and registry modifications within the Windows Task Scheduler tree.
This rule detects suspicious directory creation or file attribute modifications within the 'naverwhale' roaming AppData directory. Adversaries may use this path to stage malicious payloads, persistence mechanisms, or to impersonate legitimate browser files.
Detects execution of potential Python-based backdoors or loaders that reference specific configuration files named 'config.cat' or 'AccountConfig.cat'. This behavior may indicate an adversary utilizing Python for command and control or malicious script execution.
Detects the use of PowerShell command-line arguments designed to bypass or weaken execution policy restrictions. This includes setting the policy to 'Unrestricted' or 'Bypass' within a specific process scope, which is a common technique used by attackers to execute unsigned or malicious scripts.
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Detects the use of PowerShell commands that leverage Reflection.Assembly.Load, a common technique for loading .NET assemblies directly into memory. This behavior is often associated with fileless malware, reflective DLL injection, or obfuscated payloads attempting to bypass security controls like AMSI.
Detects host reconnaissance activity performed by PureLog Stealer, characterized by the execution of system administration tools (e.g., wmic, reg, systeminfo) spawned as child processes from .NET LOLBins (e.g., msbuild, installutil, regsvcs). This behavior indicates an adversary performing discovery of system configuration and environment details.
This rule detects the manual instantiation of PowerShell ScriptBlock objects via the '::Create' method. This technique is commonly used by malicious PowerShell scripts and offensive security tools to bypass traditional command-line logging by executing code dynamically in memory, often avoiding disk-based signatures.
Detects post-infection data harvesting behavior associated with PureLogs Stealer. The rule monitors specific LOLBins (.NET binaries) and suspected masqueraded payloads (e.g., syscall.exe) as they attempt to access browser credential, cookie, or web data files from Google Chrome, Microsoft Edge, and Mozilla Firefox. It also tracks the creation of these suspicious processes when invoked by scripting interpreters like PowerShell, wscript, or cscript.
Detects the execution of base64-encoded shell commands on macOS, a pattern commonly associated with the 'ClickFix' social engineering campaign where users are tricked into copying and pasting malicious payloads into their Terminal.
Page 157 of 977