Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects post-exploitation command execution originating from a compromised explorer.exe process. The rule identifies processes like cmd.exe, powershell.exe, or conhost.exe spawned by an explorer.exe instance that has previously loaded the malicious 'MicrosoftEdgeUpdateCore.dll' module, correlating this activity with the established 'tailcat.exe' command-and-control tunnel.
Detects post-exploitation command execution originating from a compromised explorer.exe process. The rule identifies processes like cmd.exe, powershell.exe, or conhost.exe spawned by an explorer.exe instance that has previously loaded the malicious 'MicrosoftEdgeUpdateCore.dll' module, correlating this activity with the established 'tailcat.exe' command-and-control tunnel.
Detects post-exploitation command execution originating from a compromised explorer.exe process. The rule identifies processes like cmd.exe, powershell.exe, or conhost.exe spawned by an explorer.exe instance that has previously loaded the malicious 'MicrosoftEdgeUpdateCore.dll' module, correlating this activity with the established 'tailcat.exe' command-and-control tunnel.
Detects the execution of known Remote Monitoring & Management (RMM) software on Windows systems. This behavior is frequently abused by threat actors, including Scattered Spider, to maintain persistent access after gaining control via social engineering or identity-based attacks (e.g., vishing-driven credential or MFA resets).
Detects evidence of a SharePoint pre-authentication RCE exploit chain where an adversary injects a malicious Namespace containing an ExpandedWrapper-wrapped XamlServices payload (e.g., ObjectDataProvider or LosFormatter gadget) into the w3wp.exe worker process. This specifically looks for command-line arguments indicative of deserialization-based exploit attempts targeting SharePoint web server components.
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Detects scenarios where common download utilities are used to fetch a file from the internet, followed by the immediate execution or loading of that same file within a 10-minute window, indicative of an Ingress Tool Transfer followed by execution.
Detects attempts to disable Windows Defender features via PowerShell, terminate critical security services using administrative tools like sc.exe or net.exe, or inject/patch AMSI (Antimalware Scan Interface) within a process context to evade detection.
Detects the execution of the Graphalgo RAT second-stage payload. The rule identifies the spawning of a detached 'go run .' process, which performs an ephemeral key exchange using a hardcoded public key before C2 establishment. It also correlates this activity with parent processes common in software build environments (npm, terraform, go) to differentiate malicious staging from developer activity.
Detects the 'ClickFix' technique where a user is socially engineered into copying a malicious command to their clipboard and pasting it into the Windows Run dialog (Win+R). The rule monitors for powershell.exe spawned by explorer.exe containing specific social engineering keywords or typical fileless download-execute patterns like 'irm', 'iex', or 'Invoke-RestMethod'.
This rule detects the suspicious use of signed Windows binaries (rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe) to execute remote content via URLs or scripts, or when triggered by common office applications and browsers. This behavior is often indicative of living-off-the-land (LotL) techniques used for download/execution of payloads or bypassing security controls.
Detects the creation of new Windows services using sc.exe or PowerShell where the binary path is located in common user-writable or temporary directories (e.g., Temp, AppData, ProgramData), or where the service name mimics legitimate Windows system services, a technique often used for persistence or lateral movement (e.g., PsExec).
Detects the use of legitimate Windows binaries (LOLBins) certutil.exe and bitsadmin.exe for suspicious activities such as downloading files via URL or decoding encoded files. This rule explicitly excludes known legitimate administrative activity originating from Microsoft Configuration Manager (SCCM).
This rule monitors for persistence mechanisms by detecting modifications to Windows Registry Run/RunOnce keys or the creation of files within the Windows Startup folder. It specifically flags instances where the executable or script being registered resides in high-risk directories such as Temp, AppData, or Downloads, and correlates these events with recent process execution to confirm the persistence activity.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as mshta, certutil, regsvr32, rundll32, and msiexec, where the command-line arguments contain suspicious patterns indicative of script execution or remote file fetching. These behaviors are consistent with T1218 (System Binary Proxy Execution) to bypass security controls by utilizing trusted, signed binaries to execute malicious code.
This rule detects potential lateral movement via WMI by identifying two distinct suspicious behaviors: WmiPrvSE.exe spawning unexpected child processes (excluding common legitimate processes) or the usage of wmic.exe and PowerShell cmdlets (Invoke-WmiMethod, Invoke-CimMethod) to execute processes on remote systems, as indicated by command line arguments specifying target nodes or computer names.
Detects unauthorized or suspicious use of Windows Management Instrumentation (WMI) for lateral movement and remote code execution. The rule monitors for common WMI exploitation vectors, including the use of wmic.exe for process creation, PowerShell or C# invocations of WMI/CIM methods (such as Win32_Process Create), WMI event subscription registration for persistence, and the execution of mofcomp.exe.
Detects the abuse of Windows signed binaries (LOLBins) rundll32.exe and regsvr32.exe for proxy execution. Rundll32.exe activity is monitored for the use of javascript: pseudo-protocol or comsvcs.dll for MiniDump operations, while regsvr32.exe activity is monitored for Squiblydoo-style remote scriptlet execution via /i:http and other suspicious flag combinations.
Detects the execution of PowerShell with suspicious command-line arguments often used by adversaries for obfuscation, evasion, or in-memory code execution, such as encoded commands, hidden windows, and downloading external content.
Detects the creation of scheduled tasks using schtasks.exe that either trigger on user logon or startup and point to common writable directories (e.g., Temp, AppData), or tasks created with a remote system argument, which is frequently used by adversaries for persistence or lateral movement.
This rule detects the use of native Windows utilities certutil.exe and bitsadmin.exe for potentially malicious purposes. Specifically, it flags certutil.exe being used for decoding or cached URL operations, and bitsadmin.exe being used to initiate file transfers from remote URLs or network paths. These tools are commonly abused by attackers for file staging, ingress tool transfer, and deobfuscation of malicious payloads.
Page 88 of 976