Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects instances of common web browser processes (Chrome, Firefox, Edge, etc.) spawning command-line interpreters or scripting hosts (PowerShell, cmd.exe, mshta.exe, wscript.exe, cscript.exe). This pattern is consistent with ClickFix social engineering attacks, where users are manipulated into copying and executing malicious commands from a fake CAPTCHA or error prompt.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
Detects PowerShell executing Base64-encoded commands, often used by malware like Potemkin Loader (ClickFix payload), to evade basic string matching. The detection specifically looks for PowerShell processes initiated by explorer.exe with a command line containing a Base64-encoded string.
Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.
This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
Detects attempts to clear Windows Event Logs via common administrative tools such as 'wevtutil.exe', PowerShell, or the detection of specific system events indicating logs have been cleared (Event IDs 1102 and 104).
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
This rule detects multiple behavioral indicators associated with malware deployment, including PyInstaller environment artifacts, reconnaissance via system utilities (wmic, tasklist), and suspicious process hollowing/stager chains (e.g., mshta/wscript/cscript invoking PowerShell followed by payload execution from temporary directories). These behaviors are often associated with loaders like BQTLock and Remcos.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
Detects a Python loader process spawned by VS Code or Node.js environments that exhibits suspicious network activity indicative of fetching the InvisibleFerret infostealer, correlated with the installation of Python dependencies via 'pip' within a 10-minute window. This behavior is associated with the Lazarus Group 'Contagious Interview' campaign.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects the execution of command-line processes (e.g., PowerShell, cmd, mshta) where the command arguments contain indicators of copy-paste lures commonly associated with social engineering, such as fake CAPTCHA verification, human verification requests, or 'not a robot' prompts. This behavior is indicative of an attacker tricking a user into executing malicious code via their system's command interpreter.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.
Page 69 of 191