Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
Detects the creation of a scheduled task using 'schtasks.exe' with specific command-line arguments that indicate an attempt to establish persistence. The rule looks for 'schtasks.exe' creating a task named 'Runtime Broker' that executes a program from a suspicious path within 'C:\ProgramData\Microsoft\Windows\Runtime\'. This pattern is often used by adversaries to maintain access to a system.
KQL Query from file: INC Ransomware Command Execution
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Detects execution of OneDriveUpdater.exe from C:\ProgramData, which may represent a masqueraded binary attempting to impersonate legitimate Microsoft software. This could indicate an attempt at defense evasion or persistence by an attacker.
LOLBAS shell32
S1QL
This rule detects the execution of `rundll32.exe` with `shell32.dll` that subsequently launches `cmd.exe`. This behavior is often associated with adversaries using `rundll32.exe` as a proxy to execute commands, specifically leveraging `shell32.dll` to invoke `cmd.exe`. The rule includes several exclusions to reduce false positives, such as legitimate `msiexec.exe` parent processes, specific `RunDLL` commands, and `autorun.bat` related activities.
Detects the execution of rundll32.exe with command-line arguments indicative of running an HTML Application (mshtml,RunHTMLApplication) or directly executing JavaScript. This technique is often used by adversaries for code execution and bypassing security controls.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
This rule detects potential data poisoning attacks targeting machine learning models by monitoring Windows Security Event ID 4688 (a process was created) for command-line activity containing keywords indicative of model training or dataset modification, combined with terms suggesting malicious intent like 'corrupted', 'poison', or 'injection'. It aims to identify attempts to manipulate or compromise ML models through their training data.
This rule detects the creation of new processes (Event ID 4688) where the command line contains keywords indicative of driver or kernel module installation or loading. It looks for combinations of terms like 'driver', 'kernel', 'sys' along with 'install' or 'load'. This activity can be a sign of rootkit installation or other malicious kernel-level modifications.
This rule detects an unusual number of software uninstall activities on a system within a one-hour window. It specifically looks for command lines containing 'uninstall' or 'remove' along with 'KB' (Knowledge Base update) or 'package', which could indicate an attempt to remove security updates or other software.
This rule detects an unusual number of process creations (Event ID 4688) containing both 'security' and 'patch' in their command line within a one-hour window on a single computer. This could indicate automated patching activity, but a high volume might also suggest suspicious system modifications or an attempt to disguise malicious activity as legitimate patching.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects the creation of new processes where the command line contains keywords such as 'exploit' or 'vulnerability'. This could indicate an attempt to execute an exploit or leverage a known vulnerability, potentially as part of an attack.
Detects the use of BITSAdmin to create or modify background intelligent transfer jobs. Attackers often abuse BITSAdmin to download malicious payloads (ingress tool transfer) or to execute commands when a transfer job completes or errors, which can be leveraged for persistence or arbitrary code execution.
Detects the use of regsvr32.exe with the /s (silent) and /u (unregister) flags to execute a remote scriptlet file (e.g., .sct, scrobj.dll) via HTTP, a common technique for proxy execution and bypassing application control mechanisms.
Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.
Page 448 of 976