Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of regsvr32.exe with the /s (silent) and /u (unregister) flags to execute a remote scriptlet file (e.g., .sct, scrobj.dll) via HTTP, a common technique for proxy execution and bypassing application control mechanisms.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
Detects Microsoft SQL Server (sqlservr.exe or mssql.exe) spawning common administrative or potentially malicious utilities (e.g., cmd.exe, powershell.exe, curl.exe, etc.). This behavior is often indicative of unauthorized code execution or lateral movement originating from the database engine, which should not typically initiate these processes.
Detects the use of Windows Package Manager utilities (winget.exe, WindowsPackageManagerServer.exe) or ConfigurationRemotingServer.exe to execute administrative commands related to local user and group management, such as adding users or modifying group memberships. This behavior is highly irregular for these binaries and suggests potential abuse for persistence or privilege escalation.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
This rule detects lateral movement activity and implant deployment patterns associated with the threat group OceanLotus (APT32). It monitors for the creation of specific suspicious files and paths often used by SPECTRALVIPER/WINDSHIELD malware, identifies file transfers over SMB orchestrated by system processes, tracks the execution of remote administration tools like PsExec, and identifies internal pivot activity via named pipes.
Detects the SQL Server process (sqlservr.exe) spawning suspicious child processes often associated with reconnaissance or command execution, such as command shell, PowerShell, or network diagnostic utilities. This is a common technique used by adversaries to execute commands or perform post-exploitation activities via database services.
Detects Python scripts with reverse shell socket connection patterns
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Detects the Windows Package Manager (winget.exe) spawning the ConfigurationRemotingServer.exe process. This behavior, observed when using the 'winget configure' command, may indicate the execution of embedded PowerShell DSC scripts that can be used to maliciously configure a machine.
Detects instances where the Microsoft SQL Server process (sqlservr.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative tools. This behavior is often indicative of remote code execution exploitation or post-exploitation activities following initial access on a database server.
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects the deletion of volume shadow copies using standard Windows utilities like vssadmin.exe or wmic.exe, combined with concurrent file activity in multiple directories, a behavior frequently observed during the impact phase of a ransomware attack (specifically associated with the Qilin ransomware family).
Detects instances where the Windows Subsystem for Linux (wsl.exe) process is used to launch standard Windows command-line interpreters (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used as a technique to facilitate cross-environment execution or to evade certain security controls by running Windows binaries from within the WSL context.
Detects the execution of the Linux uptime utility, either as a standalone process or via common web server parent processes (nginx, httpd, apache), particularly when associated with suspicious command-line arguments or network activity. This behavior is often associated with reconnaissance or post-exploitation activities.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
This rule detects various activities related to the Windows Subsystem for Linux (WSL), specifically focusing on: 1) Executing network tools like curl or wget via wsl.exe, 2) The creation of executable or script files in suspicious directories (User\Public, ProgramData, Windows\Temp) by DllHost.exe, and 3) The execution of wsl.exe or wslhost.exe. These behaviors are often associated with adversaries using WSL to bypass security controls, stage payloads, or facilitate command-and-control communication.
Detects instances where the Windows Subsystem for Linux (WSL) process spawns a Windows command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is often used to execute native Windows commands from within a Linux environment, potentially as a technique for stealthy command execution or to bypass traditional Windows-based monitoring and security controls.
Page 411 of 976