Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,453
11,838
5,876
5,154
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
Detects the execution of a renamed Python executable (csshost.exe) running Python scripts. This behavior is a known defense evasion technique associated with the PyLangGhost RAT, which is deployed by the NICKEL ALLEY threat group in their Contagious Interview campaigns.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
Detects PowerShell commands attempting to retrieve the installed UI culture name. This specific technique is utilized by the EtherRAT SYS_INFO module to check the system's locale and selectively self-destruct on CIS-region machines.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
Detects the execution of VBScript files via wscript.exe or cscript.exe originating from the C:\Users\Public\ directory. This behavior is highly suspicious and indicative of malware staging, as observed in the FAUX#ELEVATE campaign.
Detects the Faux-Elevate UAC bypass technique where auto-elevated binaries (fodhelper.exe, eventvwr.exe) are abused to launch suspicious child processes like PowerShell or cmd.exe. The detection logic further correlates this with registry modifications related to UAC bypass (specifically 'Software\Classes\ms-settings\shell\open\command') and subsequent outbound network activity to retrieve payloads, indicating a full chain of execution and C2 communication.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
Detects PowerShell processes executing commands that combine `Invoke-Expression` (iex) and `Invoke-RestMethod` (irm) with an HTTP or HTTPS URL. This combination is often used by adversaries to download and execute malicious scripts or payloads directly from the internet, without writing them to disk. The rule includes exclusions for known legitimate installers like the UV installer launched by trusted processes.
Detects non-standard processes (e.g., command shells, script hosts) loading WinRT notification and push app libraries (wpnapps.dll, notificationcontroller.dll), which may indicate an implant or script attempting to send spoofed toast notifications for social engineering.
Detects the execution of JavaScript code within the Deno runtime via data URIs. This technique can be used by adversaries to execute in-memory payloads, bypassing traditional file-based detection mechanisms. The rule specifically looks for 'deno.exe' in the process filename or original filename and the presence of 'data:application/javascript' in the process command line.
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects the creation of batch or command scripts in the Windows Startup folder. This is a common persistence technique used by malware like VOID#GEIST (spol.bat) to ensure execution on user logon. The rule specifically looks for file creation events of .bat or .cmd files in the Startup folder, initiated by processes commonly associated with malicious downloads or script execution such as cmd.exe, powershell.exe, curl.exe, cscript.exe, and wscript.exe.
This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.
Detects the Deno runtime executing base64-encoded payloads via data URIs. This technique is used by threat actors, such as LeakNet, to run JavaScript payloads directly in memory, evading traditional file-based detection.
This rule correlates the creation of a potentially executable or script file by a browser or Microsoft Office application with its subsequent execution within a short time frame. This pattern is highly indicative of a user being tricked into downloading and running a malicious payload, often associated with initial access techniques like spearphishing with malicious attachments.
Detects 'Early Bird' Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes. This technique involves a suspicious parent process (like a script interpreter) creating a suspended 'explorer.exe' process, then injecting malicious code using API calls such as 'QueueUserAPC' and 'WriteProcessMemory' before the process fully starts. This rule specifically looks for the combination of these events within a short timeframe.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the execution of PowerShell or VBScript scripts matching the naming conventions "Romeo*.ps1" or "Juliet*.vbs". These scripts are utilized as initial triggers for a stealthy Deno-based in-memory loader, a technique recently observed in LeakNet ransomware campaigns following initial access.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects suspicious PowerShell execution patterns commonly associated with the ClickFix initial access technique, where a user is tricked into pasting and executing a malicious script.
Page 148 of 191