Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,008 detections
Filters
Last updated
All Time
Detection languages
1,930
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,427
11,813
5,871
5,145
4,864
4,008
Platforms
3,584
660
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,296
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
This package searches endpoint processes for cscript executing a wsf file which has been attributed to the Serpentine#Cloud campaign.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This hunt looks for PowerShell being executed as a child or grandchild of mshta.exe or network events initiated by PowerShell as a child of mshta.exe.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
KQL Query from file: NauthNRPC Detection
Detects the creation of known offensive PowerShell scripts used for exploitation, reconnaissance, credential access, persistence, and other malicious activities. The rule identifies specific filenames associated with popular PowerShell offensive security frameworks and tools.
KQL Query from file: Malicious NPM Package post install script
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: ClickFix social engineering attack detection
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
KQL Query from file: Cookie-Bite Detection
KQL Query
KQL Query
Page 169 of 191