Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Hunts for custom PowerShell RC4 decryption routines utilizing hardcoded byte arrays to unhook AMSI or decode subsequent stages. This rule specifically looks for PowerShell command text containing patterns indicative of byte array assignments (e.g., `]$var = 0x...`) and the `bxor` operator, which is commonly used in RC4 decryption routines.
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
Detects the access of VPN configuration files (e.g., .ovpn, .vpn, vpn*.conf) by common Windows command interpreters (powershell, pwsh, cmd, wscript, mshta) or archivers (WinRAR). This behavior is often indicative of automated credential harvesting or malicious configuration exfiltration, as legitimate VPN clients are explicitly excluded from this rule.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects attempts to tamper with security monitoring mechanisms including AMSI, ETW, and PowerShell Script Block Logging by monitoring process command line arguments for termination or configuration modifications and tracking registry key modifications related to these security features.
Identifies MSHTA executing embedded VBScript that suppresses its window while instantiating the Shell.Application COM object to launch subsequent scripts.
Detects PowerShell commands that intentionally disable SSL certificate validation, which can be used by attackers to bypass security controls and trust their malicious HTTPS infrastructure. This technique is often associated with the 'InstallFix' malware.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by performing in-memory patching of the AmsiScanBuffer function within amsi.dll. The rule identifies suspicious memory manipulation operations (VirtualProtect, WriteProcessMemory) performed by script hosts (PowerShell, WScript, CScript) involving PAGE_EXECUTE_READWRITE permissions or specific memory modification patterns (0xB8 opcode patching) indicative of disabling security scanning capabilities.
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects AutoHotkey (AHK) scripts spawning specific .NET Framework processes (cvtres.exe, AddInProcess32.exe, AppLaunch.exe, aspnet_compiler.exe), which is indicative of process hollowing, often used by malware like AsyncRAT to inject malicious code into suspended legitimate processes.
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory.
Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).
Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
Page 108 of 191