Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
This rule detects potentially malicious use of the Windows Installer binary (msiexec.exe) by monitoring for command-line arguments involving remote network resources (HTTP/HTTPS/UNC paths) or suspicious local directories (Temp, AppData, Downloads). Such patterns are indicative of living-off-the-land techniques used to proxy execution, download and install payloads, or perform silent/unauthorized software installations.
Detects the creation of scheduled tasks named 'MicrosoftEdgeUpdate' or 'MicrosoftEdge' that execute files located in non-standard directories such as ProgramData or Temp. This is a common technique used by threat actors to achieve persistence while masquerading as legitimate update services.
Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.
Detects the registration of a broadcast receiver for the 'BOOT_COMPLETED' intent, a technique commonly used by Android malware to achieve persistence by executing code automatically upon device startup.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects the execution of known Kerberoasting tools or commands, specifically identifying the use of Rubeus, GetUserSPNs, or processes containing strings related to Kerberoasting, which indicates attempts to extract Kerberos service tickets for offline brute-force attacks.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects the execution of command-line processes (e.g., PowerShell, cmd, mshta) where the command arguments contain indicators of copy-paste lures commonly associated with social engineering, such as fake CAPTCHA verification, human verification requests, or 'not a robot' prompts. This behavior is indicative of an attacker tricking a user into executing malicious code via their system's command interpreter.
Detects the execution of ScreenConnect.ClientService.exe with command line arguments containing 'servermanagemen' or 'Microsoft Update Service'. This pattern is often associated with the use of ConnectWise (ScreenConnect) remote access software, which can be leveraged for legitimate administration or malicious remote control.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects potential defense evasion using common Windows LOLBins (Living off the Land Binaries) to execute code from untrusted locations or remote sources. Specifically targets mshta.exe loading remote HTA files, regsvr32.exe performing Squiblydoo-style COM scriptlet execution via URL, and rundll32.exe executing DLLs from user-writable directories like Temp or AppData.
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Page 367 of 977