Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects the abuse of msiexec.exe to perform suspicious actions such as fetching payloads from remote URLs, UNC paths, or loading from user-writable directories (e.g., AppData, Temp, ProgramData). The rule further correlates this with msiexec spawning suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which is indicative of malicious post-exploitation activity.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
This rule detects the use of 7za.exe to extract specific files (data2.bin) from an archive using a hardcoded password while located within an Avast Software directory. This behavior is indicative of potential malicious activity involving the tampering or extraction of security software components or data.
Detects the execution of Control Panel (.cpl) files using rundll32.exe or dllhost.exe. Adversaries frequently use these system binaries to proxy the execution of malicious payloads, as .cpl files are technically DLLs that export CPlApplet functions and can bypass certain application allowlisting restrictions.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) or command-line tool (wmic.exe) initiates potentially suspicious child processes, often indicative of lateral movement or remote command execution via WMI.
Detects the use of 7-Zip (7z.exe) executed via the command-line interpreter (cmd.exe) to interact with a specific data file named 'data.dat' associated with the 'Traiolx Custom Utils' project, which may indicate data staging or archival activities performed by an adversary.
Detects process execution patterns associated with the LegionLoader malware staging area ('Traiolx Custom Utils'). It monitors for unsigned processes launched from this directory or processes spawned by common loaders like msiexec.exe, cmd.exe, or dllhost.exe that exhibit artifacts linked to the malware's anti-debugging and infection routines.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects the use of net.exe or net1.exe to perform enumeration of local administrators or domain-level users and groups. This behavior is commonly associated with attackers attempting to map out the environment for privilege escalation or lateral movement.
Detects LegionLoader-like behavior where msiexec.exe creates a temporary MSI file in the system temp directory and subsequently executes it using the msiexec command line utility, a pattern often used to proxy malicious payload execution while evading detection.
Detects the use of nslookup.exe to query DNS TXT records from non-Microsoft signed processes. This behavior is often associated with DNS-based Command and Control (C2) channels or data exfiltration techniques where small amounts of data are encoded within DNS TXT records.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
This rule detects common Windows processes (msiexec, cmd, dllhost, or rundll32) attempting to detect the presence of a debugger by calling 'IsDebuggerPresent' or 'SetUnhandledExceptionFilter' within their call stack. This behavior is often associated with malware or malicious tools attempting to evade dynamic analysis in sandbox or debugged environments.
Detects the execution of 7z.exe with specific command line arguments that include references to 'data.dat' and 'Traiolx Custom Utils', which may indicate the use of 7-Zip for staging or archiving collected data for exfiltration.
Detects evidence of the 'smart_window' campaign, which exploits Firefox's SmartWindow feature to exfiltrate private browsing URLs. The rule identifies suspicious outbound network requests to attacker-controlled endpoints containing specific query parameters, the creation of known PoC artifact files, and the spawning of unexpected child processes by the Firefox browser.
Detects the use of PowerShell to silently download and install a Remote Monitoring and Management (RMM) tool, identified by common RMM executable names and silent installation parameters.
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
Page 381 of 977