Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
53
41
19
16
11
Contributors
30
19
17
16
10
Categories
117
68
24
15
14
Platforms
143
3
2
1
1
Products / Services
54
41
35
19
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
2
2
2
Detects use of net time command for system time discovery
Detects enumeration of network shares via net view command
Detects the Intune Management Extension agent spawning command interpreters. Because Intune executes scripts as SYSTEM, monitoring the resulting behavior on the endpoint is critical for identifying malicious script deployments.
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Detects repeated execution of 'net.exe' with commands related to user or group enumeration (e.g., 'net user', 'net localgroup', 'net group') without adding accounts. This behavior can indicate an adversary performing account discovery on a system or within a domain.
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
Detects mass service termination targeting backup, database, and virtualization services. The Gentlemen stop Veeam, SQL, Oracle, SAP, Acronis, BackupExec, PostgreSQL, Docker, and VMware services before encryption.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects the use of "net.exe" to mount a remote WebDAV share, where the command is recorded in the Explorer RunMRU registry key. This technique was observed in a recent ClickFix campaign for initial access.
Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.
Detects local accounts being added to the Administrators group using net.exe, net1.exe, or cmd.exe.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
Detects the IIS worker process (w3wp.exe) spawning a command-line interpreter or reconnaissance tool. This is a common behavior of web shells and in-memory backdoors like IIServerCore, which is part of the NET-STAR malware suite used by the Phantom Taurus APT group.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
This rule detects specific command-line patterns associated with Snatch ransomware activity. Specifically, it looks for commands that immediately reboot the system into safe mode ('shutdown /r /f /t 00') and commands that stop the 'SuperBackupMan' service ('net stop SuperBackupMan'). These actions are characteristic of Snatch ransomware's evasion and impact tactics, where it reboots into safe mode to bypass security software and stops backup-related services to facilitate encryption.
This rule detects the execution of common Windows command-line utilities used for system network configuration discovery. Adversaries often use these commands to gather information about the network environment, including IP addresses, network interfaces, ARP tables, NetBIOS information, and routing tables. The specific commands monitored are 'ipconfig /all', 'netsh interface show interface', 'arp -a', 'nbtstat -n', 'net config', and 'route print'.
Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Page 3 of 7