Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.
Detects the Node.js bootstrapping script executing inside an Electron IDE context, specifically looking for 'gus-node-bootstrap.js' being executed by common IDE processes like Code.exe (VS Code), cursor.exe, or vscodium.exe. This activity is associated with the UNK_DeadDrop phishing campaign targeting developers.
Identifies string splitting techniques used in Dropping Elephant downloaders to evade static PowerShell logging. The rule specifically looks for obfuscated substrings like 'iw''r', 'g''c''i', 'r''e''n', 'c''p''i', and 'g''cm sch' within PowerShell command lines.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the main file executed.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
This rule detects suspicious execution of wscript.exe or cscript.exe that involves VBScript or VBE files and contains keywords commonly associated with financial documents or urgent notifications in the command line. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating phishing attempts or malware execution.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
This rule detects multiple executions of VBScript or VBE files via wscript.exe or cscript.exe within a one-hour window, where the command line contains keywords commonly associated with malicious documents or phishing attempts (e.g., 'Invoice', 'Bill', 'Urgent', 'Payment'). This behavior can indicate user execution of a malicious script, often delivered via phishing.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file name.
Detects the execution of wscript.exe or cscript.exe (Windows Script Host) from a parent process that is not commonly associated with legitimate script execution. This can indicate malicious script execution, potentially bypassing security controls or being part of an initial access or execution chain. Exclusions are made for common legitimate parent processes like explorer.exe, cmd.exe, powershell.exe, svchost.exe, system.exe, and web browsers.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions from a single device within an hour is flagged, indicating potential malicious activity like phishing or malware delivery.
This rule detects suspicious execution of VBScript (.vbs or .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. A high count (3 or more) of such events from a single device within an hour is flagged to reduce false positives.
Detects shell/script execution from .git/hooks/ paths, especially when spawning network-connected or unusual child processes. This activity is indicative of Lazarus Group exploiting Git Hooks for persistence and credential theft within developer environments.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects the execution or presence of a script named 'proxyshell_01.sh' in process command lines. This script has been associated with MuddyWater activity, specifically in the context of exploiting ProxyShell vulnerabilities.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Identifies the Python interpreter executing scripts that import the openai or langchain module combined with OS enumeration modules (os, subprocess) to map environments contextually. This activity could indicate an adversary using AI-related libraries for reconnaissance purposes.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Page 113 of 191