Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects scripts abusing the tenant list upload feature on Cisco SD-WAN managers. Such misuse can expose customer networks or implant changes at scale. It is crucial to review who ran the script and what file was uploaded. If this alert fires, investigate the user's recent activities, specifically if they installed new software or clicked any suspicious links. Involve your security team if the situation remains unclear.
This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule spots fake AI installers that immediately launch hidden scripts on a Windows computer. Attackers dress up malware as popular AI tools so victims click without thinking. The alert means a suspicious install may be trying to run commands in the background. If this was not expected, treat it as a possible scam or break-in.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
This rule detects the execution of common command-line interpreters (powershell.exe, cmd.exe, cscript.exe) or generic executables from suspicious user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. It specifically excludes 'msbuild.exe' and 'dotnet.exe' to reduce false positives. A high count (3 or more) of such events within an hour for a given computer and user is flagged as an anomaly, indicating potential malicious activity like malware execution or persistence.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
This rule detects the presence of the string "io.popen(" within HTTP response data. This string is indicative of a Lua script attempting to execute shell commands, which is a common technique used by malware to achieve arbitrary code execution on a compromised system. The rule specifically looks for this pattern in data flowing from the server to the client (flow:to_client), suggesting a malicious script being delivered to a user's browser or an application.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
Detects fileless malware storing payloads in registry keys for evasion
Detects PowerShell command obfuscation techniques used to evade detection
This rule detects HTTP traffic where the URI contains the string "FromBase64String" (case-insensitive). This string is often associated with PowerShell or .NET code that decodes a Base64 encoded string, which can then be executed. This technique is commonly used by attackers for defense evasion to obfuscate malicious payloads.
Detects SyncAppvPublishingServer used for PowerShell proxy execution
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects the execution of 'python.exe' from within common Chromium-based browser application directories (Google Chrome, Microsoft Edge, Brave Browser). This activity is highly suspicious as Python should not legitimately execute from these paths under normal circumstances. Threat actors, such as UNK_DeadDrop, have been observed using this technique to bypass application-bound encryption path validation and steal sensitive data like browser credentials. Detection of this behavior indicates potential malicious activity, including credential theft or other forms of evasion.
Detects the creation of a firewall rule using 'netsh.exe' or PowerShell ('New-NetFirewallRule') that includes the deceptive name 'Microsoft.Windows.CloudExperienceHost'. This specific naming convention is associated with the BLUERABBIT backdoor, which uses it to allow inbound VNC remote access.
Hades Bun Payload Execution
Cortex XDR
Detects the execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This indicates potential malicious activity associated with the Hades PyPI campaign.
This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
Page 135 of 191