Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Detects instances where Windows Explorer (explorer.exe) spawns common command-line interpreters (powershell.exe, mshta.exe, cmd.exe) with suspicious command-line arguments indicative of fileless execution, obfuscation, or remote payload retrieval.
Detects DLL search-order hijacking where potentially malicious or unauthorized versions of common application DLLs (such as those from Opera or Qt5 framework) are loaded from non-standard locations like %TEMP%, %AppData%, or user-writable directories instead of their legitimate installation paths. This technique is often associated with loaders like HijackLoader/CastleLoader to execute arbitrary code within the context of a legitimate process.
Detects the use of a common PowerShell download cradle (Invoke-Expression with Invoke-RestMethod) targeting a direct IP address. This pattern is frequently observed in 'ClickFix' style attacks where users are tricked into copying and pasting malicious commands into their terminal, which then pull secondary payloads from adversary-controlled infrastructure.
Detects the execution of OS information gathering commands (e.g., uname, lsb_release) by a process that is also identified as having an active network listener. This pattern is indicative of passive backdoors or C2 agents performing reconnaissance of the host system after establishing a listener.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects the use of the Sysinternals ADExplorer tool for Active Directory environment exploration, including the creation of snapshots or data dumps, as well as the use of the native 'net' utility to enumerate domain users and groups. These activities are common indicators of internal reconnaissance and discovery phases during an attack.
Detects the execution of ADExplorer.exe with the command-line arguments to perform a snapshot export. AD Explorer is a legitimate administrative tool often abused by adversaries to perform offline NTDS.dit extraction or to enumerate Active Directory objects.
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
Detect the use of "<" to read and potentially execute a file via cmd.exe
Detects instances where known post-exploitation tools or techniques (AD Explorer snapshots, staging of screen captures in public directories, or credential stealer execution) are followed by successful outbound network connections from the same device within a 30-minute window. This behavior often correlates with the collection and subsequent exfiltration of sensitive information.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects the persistence and execution mechanism of ChocoPoC RAT, where a Python interpreter is spawned in a hidden window using the CREATE_NO_WINDOW flag (0x08000000). The rule monitors command-line arguments and parent-child process relationships for indicators of the RAT's module import, specific environment variables used for anti-recursion loops, and process spawns originating from existing Python instances.
Detects the DOGLEASH backdoor utilizing /bin/sh -c to execute arbitrary shell commands. The detection specifically looks for the execution of the Unix shell with -c arguments triggered by parent process command lines containing specific C2 command codes (0x2268 or 0x2267).
Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '../') in the destination path. This pattern is indicative of an attempt to escape the container filesystem boundary and write arbitrary files to the host system by exploiting vulnerabilities in the docker cp utility.
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Page 343 of 977