Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) spawns a command shell (cmd.exe) with command-line arguments involving standard output redirection (2>&1), often used to capture error and output streams in remote command execution scenarios. This pattern is commonly observed during lateral movement or remote administration activity.
Detects the creation of new Windows services through suspicious or unexpected process chains. This includes services spawned by WinGet/DSC components, services created by sc.exe where the process path points to user-writable directories (e.g., Temp, AppData, User profiles), or system event logs (Event ID 7045) indicating service installation from non-standard locations. This rule is designed to identify potential persistence mechanisms or privilege escalation attempts involving unauthorized service creation.
Detects the execution of ConfigurationRemotingServer.exe initiated by the Winget package manager. This activity is associated with applying system or application configuration files (e.g., .yaml configuration files) via the Windows Package Manager 'winget configure' command.
This rule detects the execution of ConfigurationRemotingServer.exe, which is the backend process used by the Windows Package Manager (winget) when applying configuration files. The detection specifically monitors for this process being spawned by winget.exe with flags indicating the acceptance of configuration agreements and the execution of a configuration command.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
Detects execution of GS-Netcat covert C2 tunnels or masqueraded 'uptime' binaries running from non-standard system paths, consistent with persistent implants used by the Velvet Ant threat actor in Operation Highland.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Detects the Windows Subsystem for Linux (WSL) process, wsl.exe, spawning common Windows binaries that are frequently used for command and script execution, potentially as a technique for indirect command execution or evasion.
Detects potential payload staging activities within a WSL2 environment where a process writes an executable or script to the Windows filesystem using the DllHost.exe (COM Surrogate) proxy. This rule uses process activity on the host to infer the presence of a WSL2 environment (wsl.exe or vmmem) and analyzes the absence of Windows-native network events, which is a characteristic pattern of WSL2-based network activity being hidden from Windows host telemetry.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup targeting critical Active Directory or system configuration files (ntds.dit, SYSTEM, or SECURITY registry hives). This behavior is often associated with credential dumping, where adversaries attempt to extract the AD database by utilizing built-in Windows backup tools to create a copy that can then be exfiltrated or processed offline.
Detects the execution of the suspicious binary 'AdgNsy.exe', including scenarios where it is spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is often associated with malicious activity, including potential persistence mechanisms or arbitrary code execution via WMI event subscriptions.
Detects browser extension renderer processes (Chrome or Edge) performing virtualization, sandbox, or debugger evasion checks. This is achieved by monitoring for suspicious WMI queries to discover virtualized environments, access to registry keys associated with virtual machine guest additions, and the loading of DLLs related to VM guest support tools.
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.
This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.
Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.
Page 388 of 977