Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
The following analytic identifies the use of the w32tm.exe utility with the /stripchart function, which is indicative of DCRat malware delaying its payload execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments used by w32tm.exe. This activity is significant as it may indicate an attempt to evade detection by delaying malicious actions such as C2 communication and beaconing. If confirmed malicious, this behavior could allow an attacker to maintain persistence and execute further malicious activities undetected.
The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for reconnaissance and system information discovery on Windows endpoints.
It identifies command-line queries targeting common Win32 WMI classes such as Win32_OperatingSystem, Win32_Processor, csproduct, Win32_DiskDrive, and Win32_PhysicalMemory, which are frequently leveraged to enumerate hardware, operating system details, and system configuration. Adversaries often use these queries during post-exploitation to fingerprint hosts, assess virtualization, and tailor follow-on activity. While WMIC usage can be legitimate for administrative and inventory tasks, suspicious or unexpected execution—particularly by non-administrative users or uncommon parent processes—may indicate malicious reconnaissance aligned with system discovery techniques.
It identifies command-line queries targeting common Win32 WMI classes such as Win32_OperatingSystem, Win32_Processor, csproduct, Win32_DiskDrive, and Win32_PhysicalMemory, which are frequently leveraged to enumerate hardware, operating system details, and system configuration. Adversaries often use these queries during post-exploitation to fingerprint hosts, assess virtualization, and tailor follow-on activity. While WMIC usage can be legitimate for administrative and inventory tasks, suspicious or unexpected execution—particularly by non-administrative users or uncommon parent processes—may indicate malicious reconnaissance aligned with system discovery techniques.
This analytic detects the use of WMIC to delete volume shadow copies, which is a common technique used by ransomware actors to prevent system recovery. Ransomware like Cactus often delete shadow copies before encrypting files to ensure victims cannot recover their data without paying the ransom. This behavior is particularly concerning as it indicates potential ransomware activity or malicious actors attempting to prevent system recovery.
The following analytic detects the execution of Windows Management Instrumentation Command-line (WMIC) commands used for computer system discovery on a Windows system. Specifically, it monitors for commands such as “wmic computersystem” that retrieve detailed information about the computer’s model, manufacturer, name, domain, and other system attributes. While these commands are commonly used by administrators for inventory and troubleshooting, they may also be exploited by adversaries to gain insight into the target environment during the reconnaissance phase of an attack. Identifying and alerting on WMIC computer system queries helps security teams recognize unauthorized information gathering and take steps to mitigate potential threats.
Detects obfuscated shell command execution on VMware ESXi as hunted by CrowdStrike, where attackers hide esxcli commands (e.g. syslog config reset for log evasion, vm process list for recon) behind decode-and-execute wrappers such as printf hex/octal escapes, awk BEGIN blocks (chr/ord/xor/zero-width-unicode/morse/binary decoders), python -c chr() reconstruction, sed/od character-reversal ciphers, and $TERM/$SHELL substring reassembly, frequently invoking /usr/lib/vmware/busybox/bin/busybox or staging output in hidden /vmfs/volumes//.sys files before piping the reconstructed command into sh.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
Detects a Chrome/Edge WebDriver process launched with headless and
automation-hiding command-line flags (--headless combined with --disable-infobars
or excludeSwitches enable-automation/test-type). Astaroth's spambot component uses
this exact flag combination to drive a hidden browser instance against an active
WhatsApp Web session, sending spam to every Brazil-based contact without ever
displaying a window to the victim.
automation-hiding command-line flags (--headless combined with --disable-infobars
or excludeSwitches enable-automation/test-type). Astaroth's spambot component uses
this exact flag combination to drive a hidden browser instance against an active
WhatsApp Web session, sending spam to every Brazil-based contact without ever
displaying a window to the victim.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
The following analytic identifies a Python process being executed where it's process name does not match
it's original file name attribute. Processes that have been renamed and executed may be an indicator that
an adversary is attempting to evade defenses or execute malicious code.
it's original file name attribute. Processes that have been renamed and executed may be an indicator that
an adversary is attempting to evade defenses or execute malicious code.
Detects a behavioral chain where PowerShell stages a hidden base64-encoded command and schedules a VBScript task, or PowerShell fetches an upgrade.txt file via web client methods for execution.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects the execution of MATCHBOIL malware variants (PlannerAssistantManager.exe or RegularExpressionExplorer.exe) using specific command-line arguments (-auto, -plans, -renew) which trigger C&C logic.
Detects the execution of MATCHBOIL malware variants (PlannerAssistantManager.exe or RegularExpressionExplorer.exe) using specific command-line arguments (-auto, -plans, -renew) which trigger C&C logic.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.
It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
The following analytic detects the execution of JScript using the cscript.exe process.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry.
This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics.
If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry.
This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics.
If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
Page 24 of 976