Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Identifies the BackgroundFix script invoking hidden PowerShell instances to retrieve updated payloads or auxiliary modules from the C2.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file.
Detects the use of common Windows living-off-the-land binaries (certutil, bitsadmin, curl, powershell) to download external files, which is a common behavior associated with staging malware loaders such as MintsLoader and D3F@ck Loader.
Detects modifications to common Windows Registry Run keys (Run, RunOnce, RunServices, RunServicesOnce) that include specific keywords ('ManageEngine', 'SystemOptimizer') and attempt to execute scripting tools (wscript, cscript, powershell, cmd). This pattern is often used by adversaries to establish persistence on a system.
Detects the deletion of local shadow copies using vssadmin, WMI, PowerShell, or wbadmin, a common tactic employed by ransomware to prevent system recovery.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects the Prinz Eugen ransomware operator leveraging RemotePC's RPCCMDHOST.EXE to spawn PowerShell with hidden window, no profile, and non-interactive flags, consistent with obfuscated stager execution observed in active intrusions.
Identifies regsvr32.exe utilizing scrobj.dll to execute a remotely hosted malicious COM script.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file.
Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.
Detects frequent execution of VBScript files using wscript.exe or cscript.exe where the command-line arguments contain suspicious keywords often associated with phishing lures or malicious documents. The rule triggers when a single device executes three or more such processes within a one-hour window.
Detects `cmd.exe` starting PowerShell with hidden-window, bypass execution policy, and encoded-content options, which is a common technique used by malware like Banana RAT to evade detection and execute malicious scripts. The rule specifically looks for PowerShell or pwsh.exe being launched with command-line arguments indicating hidden windows, execution policy bypass, or encoded commands, with `cmd.exe` as the parent process.
Detects the ZiChatBot dropper export and parameter combination used to initialise payload decryption and execution. Specifically, it looks for rundll32 or python/python3 executing 'terminate.dll' with 'envir' and 'xterminalunicod' in the command line.
Detects collection of event log size, retention, record count, and audit policy categories to understand defensive visibility. This rule specifically looks for the execution of 'powershell.exe' with 'Get-WinEvent -ListLog Security' or 'auditpol.exe' with '/get /category' command-line arguments.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
This rule detects VBScript execution (via wscript.exe or cscript.exe) that attempts to load WinHTTP objects (WinHttpRequest.5.1, MSXML2.XMLHTTP) or uses generic object creation functions (CreateObject, GetObject). This behavior is often associated with VBScripts establishing command and control (C2) communication or performing data exfiltration.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Page 97 of 191