Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.
This rule detects the creation of executable or script files (e.g., .exe, .dll, .ps1, .bat, .cmd) by wscript.exe or cscript.exe within common user-writable directories such as AppData, Temp, Downloads, Documents, or Music. This activity can be indicative of malicious VBScript execution attempting to drop and execute secondary payloads, often associated with phishing campaigns.
Detects the execution of RegSvcs.exe initiated by a VBScript (wscript.exe or cscript.exe). This technique can be used by adversaries to bypass application control and execute malicious code.
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects ClickFix payloads executing PowerShell with invoke-expression (iex) and invoke-restmethod (irm) to fetch remote payloads into memory without touching disk, as seen in DeepLoad delivery.
This rule detects the execution of 'cmd.exe' with a command line that includes 'type', '.pdf', 'more', and 'findstr'. This specific combination of commands is indicative of a technique used by AsyncRAT to extract and execute malicious code hidden within a decoy PDF file by reading specific line ranges.
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
LdrCallEnclave shellcode execution
Cortex XDR
This rule detects the use of LdrCallEnclave, a function often associated with shellcode execution, when initiated by Python or an executable located in a user-writable temporary directory (e.g., Temp, AppData, ProgramData). The detection focuses on processes whose image name matches 'python', 'python3', or any executable name followed by '.exe', and whose path contains common temporary or user-writable directories. The rule specifically looks for 'ldrcallenclave' in the command line arguments, indicating potential malicious activity such as process injection or shellcode execution.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Detects PowerShell executing heavily obfuscated commands utilizing both Base64 conversion and DeflateStream decompression, a signature of the Codex loader.
Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.
Tracks the escalation of a Potentially Unwanted Program (PUP) installer executing wscript.exe, which then spawns powershell.exe, finally culminating in the execution of the AutoIt3 interpreter. This sequence is indicative of a common Remote Access Trojan (RAT) loader technique.
Detects PowerShell executing a one-liner Invoke-WebRequest to pull the TiFlux installer directly from an attacker-hosted repository or the vendor.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load to execute the compiled ClassLibrary stage filelessly.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
This rule detects PowerShell executing a payload deceptively named as a JPEG image file, specifically 'sysupdate.jpeg', followed by subsequent outbound network activity. This behavior is indicative of the SilentCanvas campaign.
This rule detects potential persistence mechanism installation by monitoring the creation of registry values in 'Run' or 'RunOnce' keys, followed by the execution of 'powershell.exe' or 'wscript.exe' on the same host within a 5-minute window.
Page 126 of 191