Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,445
11,833
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects a suspicious process chain involving wscript.exe spawning powershell.exe, which then spawns MSBuild.exe. This specific chain is characteristic of the SHADOW#REACTOR malware campaign, indicating potential execution of malicious code via trusted utilities.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.
Detects the execution of PowerShell or VBScript commands that contain indicators of base64 encoding. This is a common obfuscation technique used by malware like DarkGate to hide malicious payloads, often seen in social engineering campaigns like "ClickFix".
Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.
This rule detects attempts to discover Group Policy settings on a Windows system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, and PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. Additionally, it looks for LDAP-related commands or patterns ('ldapsearch', 'groupPolicyContainer') that might indicate GPO discovery via directory services. The rule also correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) to further confirm GPO-related activity.
Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects when a WebKit-based browser process on macOS spawns a shell or script interpreter. This is highly suspicious and can indicate successful exploitation of a browser vulnerability for initial code execution.
This rule detects attempts to discover Group Policy settings on a system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy', and LDAP-related queries for 'groupPolicyContainer'. Additionally, it correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) that also contain 'groupPolicyContainer' in the URL, indicating potential GPO access. The rule filters out common system processes to reduce noise.
Detects a browser hijacking technique where a WMI-driven script terminates a running browser process (Chrome or Edge) and immediately restarts it with malicious command-line arguments to load an unauthorized extension.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects a PowerShell process that downloads a ZIP archive and extracts it to the ProgramData directory. This behavior is characteristic of the final stage of the JS#SMUGGLER campaign, which uses this technique to deploy the NetSupport RAT.
Detects PowerShell execution patterns consistent with the ClickFix malware campaign, which uses obfuscated scripts to decrypt and reflectively load a .NET assembly in memory. This activity is detailed in Stage 2 of the infection chain. The query identifies command lines with combinations of keywords used for decoding, decryption, and in-memory execution, specifically looking for 'FromBase64String' combined with 'Reflection.Assembly' and 'Load' for reflective loading, 'FromBase64String' and '-bxor' for XOR decryption, or 'FromBase64String' and 'Invoke-Expression'/'IEX' for executing decoded scripts in memory.
Page 158 of 191