Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of QEMU binary components (qemu-system-x86_64.exe, etc.) on Windows hosts when spawned by suspicious parent processes or with command-line arguments indicative of VM disk image handling or non-interactive execution. This behavior is used by threat actors to execute malicious payloads within a virtualized container to evade host-based EDR monitoring and security controls.
Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
Detects the use of Windows Package Manager (winget) or Configuration Remoting Server processes to execute account management commands such as adding users or modifying group memberships via net.exe or PowerShell. This behavior is indicative of privilege escalation or persistence attempts using legitimate administrative tools.
This rule detects potential malicious scheduled task creation behavior linked to the Windows Package Manager (WinGet) and Desired State Configuration (DSC) components. It monitors for two primary indicators: first, the 'schtasks.exe' process being spawned by WinGet-related binaries (or via PowerShell in that context); second, Windows Event ID 4698 (a new scheduled task) where the task creation context involves WinGet binaries and specifies paths commonly used for temporary or user-writable locations (e.g., Temp, AppData). This is a common pattern for attackers to achieve persistence or execute payloads by masquerading through trusted package manager components.
Detects the download of potential second-stage malicious payloads disguised as JPEG files to the C:\Windows\ directory using the URLDownloadToFile method. This activity is associated with Operation DragonReturn, where attackers save payloads as background.jpg for later decryption and execution.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
Detects the creation or configuration of Windows services spawned by WinGet-related processes such as ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is often associated with software installation or configuration management but could be abused by adversaries to establish persistence or execute code with elevated privileges.
Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.
Detects an attacker-controlled SOCKS5 proxy masquerading as the Samba daemon (smbd) by renaming the process to 'smbd' and executing it with the '-D' flag from non-standard filesystem locations such as /tmp, /home, /var/tmp, or /dev/shm. This behavior is associated with the Velvet Ant threat group, which uses this technique to maintain persistent command-and-control communication while evading detection by blending in with legitimate system processes.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects the execution of known Kerberoasting tools such as Rubeus and Impacket (GetST, GetTGT, asktgs) or command-line arguments indicative of Kerberoasting, specifically targeting RC4/ETYPE-23 ticket requests that are often used to crack service account passwords offline.
This rule detects potential misuse of the legitimate Windows utility InstallUtil.exe (a .NET component installer) to proxy the execution of malicious code. It identifies two specific suspicious patterns: first, the execution of InstallUtil with command-line arguments indicative of bypass attempts (e.g., /logfile, /LogToConsole, or /U) or loading files from user-writable directories (Temp, AppData, Downloads, ProgramData); second, instances where InstallUtil spawns potentially malicious child processes such as PowerShell, cmd, or various system binaries often used for persistence or lateral movement.
This rule detects instances where the Windows Explorer process (explorer.exe) launches a command prompt (cmd.exe). While legitimate use may occur in certain scenarios, this pattern is often associated with malicious actors attempting to gain interactive shell access or execute commands via user-initiated actions or secondary exploitation vectors.
This rule detects persistence mechanisms associated with the SystemBC/Coroxy malware. It monitors for three indicators: 1) The creation of scheduled tasks via 'schtasks.exe' where the task binary is located in 'ProgramData' and uses the 'start' argument; 2) Windows Security Event ID 4698 (Scheduled Task Created) identifying similar task actions in 'ProgramData' with the 'start' argument; 3) The creation of Registry Run keys in 'HKCU' or 'HKLM' with values containing 'ProgramData' combined with malicious arguments such as 'start', '-windowstyle hidden', or '-ep bypass'.
Detects execution of OfficeUpdater VBScript via wscript.exe or cscript.exe with specific command line arguments, or the creation of corresponding .ini configuration files. This pattern is indicative of potential malicious activity or persistence mechanisms mimicking legitimate update processes.
Detects the creation of cmd.exe with a parent process of RemoteMouse.exe or explorer.exe. This activity is indicative of synthetic keystroke injection, where malicious actors use applications like Remote Mouse to automate keyboard input—such as triggering the Start menu and typing commands—to achieve unauthorized code execution.
This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.
Page 354 of 977