Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects anomalous child process execution (PowerShell, mshta, wscript, cscript, or cmd) spawned by common web browsers, which is consistent with the execution chain of CastleLoader malware delivered via EvilTokens PhaaS and ClickFix CAPTCHA lures. These lures typically trick users into copying and pasting commands into the Run dialog or directly into the shell.
Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.
Detects automated scripts or command-line utilities initiating connections to Microsoft authentication endpoints using OAuth device code authorization parameters. This behavior is indicative of PhaaS (Phishing-as-a-Service) tools, such as EvilTokens, attempting to perform device code OAuth flows on behalf of an attacker to gain unauthorized access.
Detects anomalous child process execution from common web browsers often associated with Browser-in-the-Browser (BitB) attacks. The rule correlates browser-spawned processes like PowerShell, cmd, or mshta with concurrent, suspicious network activity targeting login or account-related domains outside of expected conferencing platforms.
This rule detects when common web browsers or messaging applications spawn suspicious child processes such as command-line interpreters (cmd, powershell, wscript, mshta) or processes associated with remote access tools (NetSupport Manager). Such behaviors are often indicative of exploitation, malicious payload delivery, or unauthorized remote access.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.
Detects attempts to clear Windows Event Logs using common utilities like 'wevtutil' or 'Clear-EventLog', or execution triggered by batch scripts (e.g., i.bat), which is often associated with adversaries attempting to remove evidence of their activities.
Detects potential CastleLoader delivery by monitoring for suspicious child process executions (e.g., PowerShell, cmd, mshta, wscript, cscript) spawned directly by common browser or email client parent processes. This behavior is indicative of a user interacting with a malicious phishing link or attachment as part of a malware delivery chain.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. This technique is often used for lateral movement and remote code execution.
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Detects the execution of node.exe from unusual parent processes and suspicious locations like AppData, Temp, or user-writable profile folders. This behavior is indicative of the TONResolver RAT, where node.exe is utilized to execute malicious JavaScript payloads disguised as legitimate processes.
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
This rule correlates process execution patterns to detect a potential malicious document or file download chain. It monitors for child processes spawned by common document viewers (Adobe Acrobat, Word, Excel, PowerPoint) or browsers (Edge, Chrome, Firefox) that subsequently launch suspicious interpreters (cmd, powershell, wscript) or tools (7z, rar), finally leading to potentially malicious payload execution within common user-writable directories, or obfuscated PowerShell command-line execution.
Detects instances where msiexec.exe or cmd.exe initiates a child process, specifically cmd.exe, to execute a batch file (.bat) located within the user's AppData/Roaming directory. This behavior is indicative of potential malicious activity, as adversaries often store and execute payloads in user-writable application data directories to maintain persistence or evade detection.
Detects LCRYX ransomware activity characterized by the execution of VBScript files via wscript/cscript, followed by attempts to disable security products (Windows Defender or third-party AVs) using command-line utilities, and establishing persistence via Registry Run keys within a 10-minute window on the same host.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
This rule detects instances where msiexec.exe spawns cmd.exe to execute a batch file located within the user's AppData\Roaming directory. This pattern is indicative of potential malicious activity where msiexec is abused as a proxy for command execution, often used by malware to launch secondary stages from user-writable directories.
Page 79 of 191