Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of PowerShell with a hidden window (-w 1) and base64 encoded arguments containing a specific string (JABVAHIAbAA). This combination is commonly used by malicious scripts or fileless malware loaders to execute obfuscated code silently.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the execution of PowerShell with the encoded command parameter (-encodedcommand or -enc), followed by a substantial base64-encoded string. This is a common technique used by attackers to obfuscate malicious PowerShell scripts, bypass signature-based detection, and execute payloads in memory.
This rule detects successful Remote Desktop Protocol (RDP) logons (Event ID 4624 with Logon Type 10) and the execution of the Remote Desktop Connection client (mstsc.exe). It monitors for signs of remote interactive access to windows endpoints, which can indicate unauthorized access or legitimate administrative activity.
Detects instances where common productivity (e.g., Office) or web browser applications spawn PowerShell.exe with suspicious command-line arguments often associated with malicious script execution or obfuscated code downloaders, such as '-w hidden', '-nop', or '-enc'.
Detects the creation of scheduled tasks using the Windows schtasks utility, specifically looking for common adversarial naming conventions or patterns such as 'MiniJunk' or recursive task names, often used to establish persistence.
Detects the initialization of the PromptSpy malware's custom 'IpcSocket' class, which establishes a TCP listener bound to the localhost (127.0.0.1) address. This mechanism is utilized for inter-process communication between various components of the PromptSpy malware to coordinate malicious activities on the Android platform.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects the execution of a VBScript file using wscript.exe, where the script is located in the user's Startup folder. This pattern is commonly used by malware to maintain persistence by ensuring the script executes automatically upon user logon.
Detects the creation of local user accounts using the Windows net.exe utility, specifically looking for accounts containing the 'rage_master_' naming convention, often used by adversaries or automated tools for maintaining persistent access.
Detects the use of WMI queries targeting the Win32_AntivirusProduct class or the root\SecurityCenter2 namespace to enumerate installed antivirus products on a Windows host. This technique is commonly used by adversaries for discovery during the reconnaissance phase to identify security controls before proceeding with further malicious actions.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains the specific strings 'MiniJunk' or 'MiniBrowse'. This pattern is often associated with the installation or persistence mechanisms of specific malicious software.
Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.
Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.
Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.
Detects the execution of PowerShell with flags commonly used to obfuscate command lines or hide activity from the user, such as -EncodedCommand or -WindowStyle Hidden. These techniques are frequently used by adversaries to execute malicious scripts while avoiding detection.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.
Detects instances where PowerShell is executed via the Windows Run dialog (explorer.exe), utilizing common download-cradle patterns (IEX/Invoke-Expression and Invoke-RestMethod) typically associated with ClickFix clipboard-hijacking social engineering campaigns.
Detects the execution of the FortigateSniffer binary or the use of the 'diagnose sniffer packet' command on FortiGate devices, which are used to passively intercept network traffic including authentication protocols like RADIUS, NTLM, and Kerberos.
Page 344 of 977