Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,478 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,164
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,478
11,861
5,881
5,162
4,867
Platforms
18,083
3,044
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,478
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records
The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, enabling attackers to escalate privileges, move laterally, or exfiltrate critical data.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects the execution of known remote administration and monitoring tools (such as Atera, Syncro, Splashtop, AnyDesk, TeamViewer, ScreenConnect, etc.) originating from user-writable or temporary directories (such as AppData, ProgramData, Users, Downloads, Windows Temp) and spawned by common application or system processes (such as browsers or explorer).
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment.
This rule detects potential persistence attempts by monitoring for the creation of suspicious registry values (common autostart locations) or new files in the Windows Startup directory. It flags registry value data or file names that match known suspicious patterns (e.g., PowerShell, cmd, temp/appdata paths, URLs) when executed by processes other than trusted installers.
Detects the use of tscon.exe to specify a destination session without a password (potential RDP session hijacking) or the creation of a Windows service related to tscon execution.
Detects crontab modifications or suspicious command execution spawned by the cron daemon on macOS devices, indicating potential persistence or scheduled task abuse.
The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations.
If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise.
The following analytic identifies system processes running from unexpected locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths, names, and hashes. This activity is significant as it may indicate a malicious process attempting to masquerade as a legitimate system process. If confirmed malicious, this behavior could allow an attacker to execute code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic detects the execution of hh.exe (HTML Help) spawning a child process, indicating the use of a Compiled HTML Help (CHM) file to execute Windows script code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where hh.exe is the parent process. This activity is significant as it may indicate an attempt to execute malicious scripts via CHM files, a known technique for bypassing security controls. If confirmed malicious, this could lead to unauthorized code execution, potentially compromising the system.
The following analytic detects the execution of `wmic.exe` with the `node` switch, indicating an attempt to spawn a local or remote process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, the attacker could gain remote control over the targeted system, execute arbitrary commands, and potentially escalate privileges or persist within the environment.
The following analytic detects the execution of sdbinst.exe with parameters indicative of silently creating a shim database. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because shim databases can be used to intercept and manipulate API calls, potentially allowing attackers to bypass security controls or achieve persistence. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
The following analytic identifies child processes spawned from "mshta.exe". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like "powershell.exe" and "cmd.exe". This activity is significant because "mshta.exe" is often exploited by attackers to execute malicious scripts or commands. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Monitoring this activity helps in early detection of potential threats leveraging "mshta.exe" for malicious purposes.
The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
The following analytic detects the use of AppCmd.exe to disable HTTP logging on IIS servers. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution events where AppCmd.exe is used with specific parameters to alter logging settings. This activity is significant because disabling HTTP logging can help adversaries hide their tracks and avoid detection by removing evidence of their actions. If confirmed malicious, this could allow attackers to operate undetected, making it difficult to trace their activities and respond to the intrusion effectively.
Page 18 of 976