Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
50
38
24
23
7
Contributors
40
31
25
23
9
Categories
46
30
28
26
26
Platforms
116
34
4
1
1
Products / Services
48
36
27
23
22
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
17
6
IDS Protocols
18
3
1
1
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
This rule detects the execution of rundll32.exe with command-line arguments indicative of Cobalt Strike's StartW function being used to load DLLs. Specifically, it looks for 'rundll32.exe' or 'rundll32 ' in the command line, along with a '.dll' file and either ' StartW' or ',StartW' as the ending argument. This behavior is commonly associated with Cobalt Strike for defense evasion and execution of malicious payloads.
Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
Page 8 of 8