Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of obfuscated PowerShell commands initiated from the Windows Run dialog (explorer.exe). This pattern is consistent with 'ClickFix' social engineering attacks where users are coerced into copying and pasting malicious, obfuscated code into the Run dialog. The rule monitors for common obfuscation artifacts such as carets, hidden window flags, encoded command arguments, and large base64-like blobs within the command line.
Detects PowerShell processes spawned from Windows Script Host (wscript.exe/cscript.exe) that interact with environment variables starting with 'Kv'. This behavior is indicative of the LausivLoader malware, which passes data between script stages via inherited environment variables to avoid using command-line arguments.
This rule monitors endpoint telemetry for occurrences of known malicious file hashes, C2 IP addresses, and C2 domains. It aggregates file creation/modification events, process execution, and network connections to detect activity associated with known malicious entities.
Detects explorer.exe spawning the genuine cmd.exe binary with an explicit /c flag to run either the doxc\doxc.bat script from the 'My Resume.iso' lure chain, or config.bat co-occurring with the Documents_Details/windowSysUpdates decoy artifacts from the Document_Detail.zip lure chain — both used by Transparent Tribe (APT-C-56) to launch CrimsonRAT or the Golang RAT.
Detects explorer.exe spawning the genuine cmd.exe binary with an explicit /c flag to run either the doxc\doxc.bat script from the 'My Resume.iso' lure chain, or config.bat co-occurring with the Documents_Details/windowSysUpdates decoy artifacts from the Document_Detail.zip lure chain — both used by Transparent Tribe (APT-C-56) to launch CrimsonRAT or the Golang RAT.
Detects the use of PowerShell to modify Windows Defender exclusions by adding the 'C:\' drive root as an exclusion path. This technique, which can be executed via 'Add-MpPreference', 'Set-MpPreference', or 'Invoke-CimMethod', effectively disables real-time scanning across the entire system drive and is often employed by adversaries to hide malicious activity from antivirus detection.
Detects instances where WScript or CScript (Windows Script Host) initiate child processes like PowerShell or Conhost, specifically when those child processes contain command line arguments referencing environment variable access pattern 'GetEnvironmentVariable' for 'Kv' keys. This pattern is commonly associated with retrieving stored configuration or sensitive data using script-based wrappers to execute logic.
Detects Ruby processes executing with arguments explicitly disabling SSL/TLS verification (OpenSSL::SSL::VERIFY_NONE) while correlating with the presence of suspicious helper scripts ('loader.rb' or 'script.rb') within Ruby gem-related directories. This behavior is indicative of an adversary attempting to perform man-in-the-middle attacks or bypass security controls for outbound C2 communications.
This rule detects PowerShell processes attempting to download specific ZIP files (e.g., DriverInstaller.zip, Automata-20.zip, ww.zip) from Backblaze B2 cloud storage buckets. This pattern is commonly associated with the delivery of malicious payloads or staged tools.
Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.
Detects the use of PowerShell cmdlets and parameters to perform system, hardware, and external drive discovery. This includes querying volume information, disk/partition details, and checking for removable or specific bus-type media (USB, SD, MMC), which is commonly associated with reconnaissance activities by an adversary.
Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.
Detects the execution of a process named 'hzwzucr_widsisa.exe' located within the 'AppData' directory. The rule further specifies that this process must be spawned by a command line initiated from 'C:\ProgramData\doxc' or by 'cmd.exe', indicating potentially suspicious activity common in malware deployment patterns.
This rule detects the execution of a batch file named 'doxc.bat' using the Windows command shell (cmd.exe) that subsequently triggers actions related to specific file paths such as 'My_Resume.pdf' or locations in ProgramData, often associated with malicious staging or execution activity.
Detects the execution of processes named 'doxc' or 'hzwzucr_widsisa.exe', or processes matching specific file hashes, when originating from common user-writeable directories like 'ProgramData' or 'AppData'. This behavior is frequently associated with malicious payloads executing in non-standard or user-specific locations to achieve persistence or evasion.
Detects execution of Windows command shells (cmd.exe, powershell.exe) performing suspicious file deletion or renaming operations involving specific filenames associated with potentially malicious activities or malware components.
Detects the use of the 'net.exe' command-line utility to connect to the hidden IPC$ administrative share on a remote system, which is a common technique used for lateral movement and remote reconnaissance.
This rule detects potentially malicious activity by monitoring for file creation events within a specific 'FitnessPrograms' directory path and the execution of suspicious processes containing keywords related to command-and-control-like behavior (e.g., 'download_and_execute', 'checkCoachInstructions').
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects the creation of a scheduled task named 'StandAloneOneDriveUpdater-2626' using either PowerShell or the schtasks utility. This naming pattern is often associated with malware attempting to persist on a system by masquerading as a legitimate OneDrive update process.
Detects the execution of common command-line utilities used for network reconnaissance and discovery, such as arp, nbtstat, net, and ping. These commands are frequently used by adversaries to map network infrastructure, identify active hosts, and discover shared resources on a target network.
Page 189 of 977