Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects command-line execution patterns involving the instantiation of potentially malicious COM objects (such as ADODB.Stream, Shell.Application, or network-related objects) using WScript.CreateObject or ActiveXObject. This pattern is commonly used in malicious JScript/VBScript to facilitate file operations, command execution, or network communication.
Detects the execution of Windows Script Host (wscript.exe) where the Interactive mode is explicitly disabled in the script content or command line arguments. Disabling interactive mode is a common technique used by attackers to ensure malicious scripts run silently without triggering UI prompts or requiring user interaction.
Detects the creation of domain user accounts using the native 'net.exe' or 'net1.exe' utilities with command-line arguments that include '/add', '/dom', and naming conventions indicating 'backup_DA' or 'backup_EA'. This pattern is often associated with adversary attempts to establish persistence or backdoors using privileged service-like account names.
Detects the installation or creation of a Windows service related to RustDesk, a remote access software application. This may indicate unauthorized installation or persistence setup of remote control tools by an adversary.
Detects the use of net.exe or net1.exe to interact with administrator accounts, specifically looking for attempts to hardcode passwords in the command line or enabling/modifying domain accounts. This is a common pattern for local account persistence, privilege escalation, or lateral movement.
Detects rapid execution of multiple system discovery commands (systeminfo, nltest, whoami, quser, ping) within a 15-minute window on a single host. Attackers often use these tools sequentially to gather intelligence about the environment, user identity, and network topography post-compromise.
Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Detects potential exploitation of the ScreenConnect SetupWizard.aspx to bypass authentication and create unauthorized administrative users. The rule monitors for the creation or modification of User.xml or Users.xml files in the ScreenConnect application directories, correlating these file events with suspicious process activity (such as cmd.exe or powershell.exe) or web requests to the SetupWizard.aspx endpoint.
This rule detects suspicious process execution chains originating from ScreenConnect (ConnectWise Control) service. It monitors for common living-off-the-land binaries (LolBins) or specific suspicious command-line patterns (e.g., encoded commands, credential discovery commands) being spawned by the ScreenConnect process, which is often abused by threat actors such as APT35/Magic Hound for remote access and persistence.
This rule detects the creation or modification of cron jobs that schedule recurring tasks (every 5 or 10 minutes) designed to download remote scripts using wget or curl and pipe them directly into a shell interpreter (sh or bash) for execution. This behavior is indicative of persistent malware, such as botnets, re-fetching and executing secondary payloads.
Detects C2Looper sideloading a malicious wtsapi32.dll from a non-System32 path by terminating and relaunching the legitimate OneDrive.exe process to load it.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects the creation of a 'SystemIn.lnk' shortcut file within the Windows Startup folder, as well as the execution of temporary PowerShell scripts ('create_lnk_*.ps1') that use WScript.Shell to establish persistence. This behavior is associated with the QUICAgent backdoor attributed to Operation QUICSILVER.
Detects execution of command shell interpreters (cmd.exe, powershell.exe) associated with specific command-and-control opcodes indicative of the LxBaseRAT remote interactive shell subsystem.
Detects the TWINLOOT Python implant's arbitrary shell command handler, in which pythonw.exe running from a non-standard directory (ProgramData, AppData, or Temp) spawns cmd.exe with a /c argument and CREATE_NO_WINDOW creation flags, consistent with the implant's default command handler executing operator-tasked commands with a hidden console window.
Detects the creation of a scheduled task using the schtasks.exe utility designed to run with SYSTEM privileges upon system startup. This behavior is often associated with persistence mechanisms where an adversary attempts to maintain long-term access by ensuring malicious code executes automatically with high privileges whenever the system boots.
The following analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process relationships and command-line executions. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.
Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Detects the creation of a local user account followed by the modification of the Winlogon SpecialAccounts\UserList registry key to hide the account from the Windows logon UI. This behavior is indicative of persistent access maintenance by adversaries, such as the Andariel threat group.
Detects the execution or installation of the cloudflared utility via PowerShell, which is often used by adversaries to establish persistence or remote access tunnels (Cloudflare Tunnel). The rule triggers on process command lines involving 'cloudflared' and '1.ps1' keywords commonly associated with scripted deployment.
Page 291 of 977