Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
Detects instances where Microsoft Teams (teams.exe) initiates child processes that are commonly used as interpreters, such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or rundll32.exe. This activity is frequently associated with the execution of malicious payloads delivered via phishing or collaboration platforms.
Detects the use of regsvr32.exe with the /s (silent) and /u (unregister) flags to execute a remote scriptlet file (e.g., .sct, scrobj.dll) via HTTP, a common technique for proxy execution and bypassing application control mechanisms.
Detects the SQL Server process (sqlservr.exe) spawning suspicious child processes often associated with reconnaissance or command execution, such as command shell, PowerShell, or network diagnostic utilities. This is a common technique used by adversaries to execute commands or perform post-exploitation activities via database services.
Detects Python scripts with reverse shell socket connection patterns
Detects the Windows Package Manager (winget.exe) spawning the ConfigurationRemotingServer.exe process. This behavior, observed when using the 'winget configure' command, may indicate the execution of embedded PowerShell DSC scripts that can be used to maliciously configure a machine.
Detects instances where the Microsoft SQL Server process (sqlservr.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative tools. This behavior is often indicative of remote code execution exploitation or post-exploitation activities following initial access on a database server.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.
Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.
Detects the deletion of a .jse file from the user's Downloads directory by Windows Script Host (wscript.exe or cscript.exe). This behavior is consistent with the NUKESPED loader's anti-forensic cleanup routine, where the initial dropper deletes itself after staging subsequent payloads in secondary locations like ProgramData.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the creation of files by WScript.exe or CScript.exe in temporary or program directories followed by the subsequent execution of those files by the same scripting host within a 120-second window. The rule specifically looks for evidence of script-based decoding or processing (e.g., via certutil or hidden windows), which is often associated with the multi-stage execution of payloads.
Detects long-running WScript or CScript processes executing script files (ending in .js or .jse) that perform environment enumeration via WMI queries (e.g., Win32_ComputerSystem, Win32_BIOS, Win32_VideoController). This behavior is often indicative of automated sandbox evasion and reconnaissance performed by malicious scripts or droppers.
Page 77 of 191