Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects the use of BITSAdmin to create or modify background intelligent transfer jobs. Attackers often abuse BITSAdmin to download malicious payloads (ingress tool transfer) or to execute commands when a transfer job completes or errors, which can be leveraged for persistence or arbitrary code execution.
Detects process execution patterns associated with OceanLotus (APT32) SPECTRALVIPER sideloading chains. The rule identifies suspicious executables by name (masquerading), specific command-line flags ('-uiDll'), execution from known staging directories, or binaries using spoofed vendor metadata with invalid or absent digital signatures.
This rule detects the creation or modification of executable files (.exe or .dll) on hidden Windows administrative shares (e.g., ADMIN$, C$, D$, IPC$), followed by the execution of a process with the same file hash on a different host within a one-hour window. This behavior is indicative of lateral movement using SMB shares to stage and execute malicious payloads.
Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.
Detects execution of mshta.exe with command line arguments containing web-related indicators (http) or scripting engines (vbscript, javascript). This behavior is characteristic of adversaries using mshta.exe as a proxy to execute remote malicious payloads or inline scripts, effectively bypassing application controls and browser security contexts.
This rule monitors network connections initiated by a process named 'setup.exe' to known malicious or suspicious IP addresses. Legitimate installers should not be initiating network connections to these specific external addresses.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
Detects the execution of rundll32.exe with command-line arguments typically used for proxy execution of scripts or malicious DLL functions (javascript:, vbscript:, ShellExec_RunDLL, LaunchINFSection), which is a common technique used by attackers to bypass security controls and execute arbitrary code, excluding instances involving comsvcs.dll.
This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.
Detects execution of a process named 'IntelAudioService.exe' located in a user-specific subdirectory under 'IntelAudio\Service\'. This pattern is frequently used by adversaries to masquerade malicious activity by mimicking the naming convention of legitimate Intel audio drivers while executing from non-standard locations.
Detects the ConfigurationRemotingServer.exe process spawning PowerShell or related host processes (pwsh.exe, conhost.exe), which may indicate the abuse of remoting or management services to execute scripts or bypass security controls.
Detects execution of 'winget configure' where the configuration file path is missing or incorrectly specified, while still utilizing automated flags like '--accept-configuration-agreements' and '--disable-interactivity'. This pattern may indicate an attempt to run winget configuration with malformed arguments or an attempt to bypass standard configuration input validation.
Detects modifications to Windows Registry Run keys that are initiated by processes related to the Windows Package Manager (winget), specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, or by PowerShell scripts spawned by these processes. This behavior may indicate an attempt to establish persistence.
This rule detects various indicators of DLL sideloading and process masquerading often associated with threat actor campaigns such as OceanLotus (APT32) and other malicious installers (FireAnt MetaKit). It monitors for specific DLL loads by unsigned or unexpected processes, the execution of masqueraded binaries, and suspicious command-line patterns used to stage malicious payloads.
Detects instances where the SQL Server process (sqlservr.exe) spawns suspicious child processes, which is a common indicator of Remote Code Execution (RCE) exploitation. This includes the execution of command shells (cmd, powershell), web clients (curl, wget), and other utilities commonly used for post-exploitation staging and payload delivery, such as those associated with potential xp_cmdshell abuse.
This rule detects abnormal process execution chains involving DSCourier.exe invoking the Windows Package Manager (WinGet) DSC engine components (WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe) via COM API, bypassing the standard winget.exe parent process. This behavior is indicative of potential process hollowing, evasion, or malicious use of built-in system management tools.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Page 449 of 976