Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
Detects potential exploitation of CVE-2017-0199 where Microsoft Office applications (winword.exe or eqnedt32.exe) spawn suspicious child processes (mshta.exe, wscript.exe, cscript.exe, powershell.exe, or cmd.exe) often associated with malicious document-based payloads like Remcos RAT. The rule monitors for both process spawning patterns and command-line arguments indicative of remote payload retrieval.
Detects the loading of DLLs by rundll32.exe from non-standard user-writable directories (AppData, Temp), often associated with infostealer clipper plugins such as clip64.dll. These patterns are commonly used by malware families like Amadey, LokiBot, and Lumma Stealer to maintain persistence or execute malicious functionality via legitimate Windows binaries.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with the '-o' flag to output to a .zip file from an HTTP/HTTPS URL, and then correlates this with a file creation event for a .zip file on the same device.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.
Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.
Detects the use of rundll32.exe to execute the 'ExecuteTask' function from a specific DLL (agt.dll) located in C:\ProgramData\CorsairUtil\. This activity is consistent with proxy-execution techniques used by Vidar/HijackLoader variants to execute malicious payloads, often triggered by a dropped loader executable.
Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.
Detects use of Responder tool for LLMNR/NBT-NS poisoning attacks
Smbexec Lateral Movement
YARA-L
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects the use of PowerShell to manually modify file system timestamps (CreationTime, LastWriteTime, LastAccessTime) on ASPX files or within common web-accessible directories. This technique is often used by adversaries to hide the true creation or modification time of webshells, facilitating anti-forensic activities and timeline corruption.
Detects suspicious child process creation originating from Adobe ColdFusion or IIS worker processes (w3wp.exe). This rule monitors for the execution of command-line shells, scripting engines, or download utilities often used in exploitation of vulnerabilities like CVE-2023-26360, CVE-2023-29298, or CVE-2023-29300.
Detects attempts to clear Windows Event Logs using common utilities including wevtutil, PowerShell (Clear-EventLog, EvtClearLog), or command-line wrappers. Clearing event logs is a common technique used by adversaries to disrupt incident response and cover their tracks after an intrusion.
Page 368 of 977