Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.
Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
Detects the execution of Microsoft Application Virtualization Injector (mavinject.exe) with the '/injectrunning' command-line argument. This utility is frequently abused by adversaries to inject malicious DLLs into target processes, facilitating arbitrary code execution while potentially bypassing security detections due to the binary's legitimate provenance.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
Detects a Python loader process spawned by VS Code or Node.js environments that exhibits suspicious network activity indicative of fetching the InvisibleFerret infostealer, correlated with the installation of Python dependencies via 'pip' within a 10-minute window. This behavior is associated with the Lazarus Group 'Contagious Interview' campaign.
Detects the execution of known Windows download utilities (curl, wget, certutil, bitsadmin, powershell) spawned directly from cmd.exe (batch script context). The rule focuses on commands referencing temporary directories or common download/transfer parameters, which are often indicative of staged malicious activity, such as fetching secondary payloads or tools.
Detects the execution of known PetitPotam exploitation tools or the use of command line arguments related to EFS RPC functions (e.g., EfsRpcOpenFileRaw) used to coerce authentication via NTLM reflection.
Detects the execution of suspicious Windows native processes spawned directly by wsl.exe. Attackers leverage WSL2 interop functionality to execute Windows-native binaries from within a Linux environment, using the wsl.exe process tree to obscure their activities and stage payloads.
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.
This rule detects the execution of common Impacket toolkit utilities, such as ntlmrelayx.py and smbserver.py, via process command line arguments. These tools are frequently used by adversaries for relay attacks, remote service execution, and credential harvesting.
Detects execution of Python interpreters used as an SMB server, specifically where the implementation is not using the standard SMB port (445). This behavior is often associated with the use of tools like Impacket's smbserver.py for lateral movement, staging, or data exfiltration, attempting to blend in by using non-standard ports.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.
This rule detects potential misuse of the legitimate Windows utility 'InstallUtil.exe' for proxy execution. It flags instances where InstallUtil is executed with suspicious command-line parameters often used for bypass techniques (e.g., logging flags or loading code from user-writable directories like Temp, AppData, or Downloads), or when InstallUtil acts as a parent process to suspicious child processes typically associated with post-exploitation activities.
Page 366 of 977