Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Detects PowerShell running base64 encoded commands
This rule detects the execution of scripting interpreters (PowerShell, WScript, CScript, MSHTA, CMD) where the initiating process's command line contains keywords related to FIFA or World Cup, suggesting a potential phishing attempt using a themed attachment. The rule aims to identify initial access attempts where users are lured into opening malicious files disguised as legitimate content (e.g., tickets, schedules, streaming links for a major sporting event).
This rule detects process command lines that indicate an attempt to execute a one-line install command from a GitHub raw content URL, often associated with untrusted or malicious projects. It specifically looks for common command-line tools used for downloading and executing scripts (like iex, Invoke-WebRequest, curl, wget, msiexec, Start-Process) in conjunction with keywords suggesting fake software or plugins (e.g., ChatGPT, Claude, AutoTune, Kontakt, plugin, installer).
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
This rule detects a suspicious chain of events starting from a web browser (Chrome, Edge, or Firefox) initiating a process like PowerShell, Cmd, Msiexec, or Rundll32. The detection is further narrowed down by looking for specific command-line arguments related to downloads or temporary directories, and crucially, by identifying that the executed payload is unsigned or has an untrusted signature. This pattern is indicative of malvertising leading to the execution of potentially malicious, unsigned software.
Detects PowerShell script executions that contain common cmdlets and classes used for downloading external payloads. This rule specifically looks for `Invoke-WebRequest`, `Invoke-RestMethod`, `DownloadString`, `DownloadFile`, `Net.WebClient`, and `Start-BitsTransfer` within PowerShell command lines, focusing on scripts executed from files.
Identifies PowerShell executing a script block directly from the specific environment variable 'INTERNAL_DB_CACHE', as observed in the Evil MSI Background steganography campaign. This technique is used to hide malicious PowerShell code within an environment variable and execute it, bypassing direct script file detection.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Detects malicious logon scripts deployed to the NETLOGON share for domain-wide execution
Detects Lua scripts executing system commands for malicious purposes
Detects Node.js executing the 'utils.cjs' script, which serves as the obfuscated malware dropper for a North Korean-linked infostealer campaign. This script is typically triggered by a malicious npm postinstall hook to download the second-stage payload.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Identifies the creation or execution of the specific JavaScript file named 'Remittance Advice.js' used in the initial access phase of the Evil MSI Background steganography campaign.
Detects the execution of the 'whoami' command when its base64 encoded string ('d2hvYW1p') appears in a process command line. This pattern is often associated with web shells or other malicious activity attempting to gain system information.
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
Page 134 of 191