Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
This detection looks at users attempting to download files from the internet using powershell / cmd commands. It measures the number of commands against a baseline set over the past 14days and if a user has performed an unusual amount of commands (also more than 5) then an alert will be created. This will detect when an attacker has compromised a user and is now attempting to download payloads from the internet or a C2.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
Detects scenarios where an attacker deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
Detects the execution of a suspicious PowerShell dropper script, often initiated by a user clicking a malicious file (e.g., LNK). This pattern is common in phishing campaigns, including those by groups like Kimsuky. The detection looks for PowerShell commands that use common evasion techniques (like hidden windows or bypassing execution policies).
No description available.
This rule detects the execution of the `certutil.exe` utility specifically when it is used with the `-exportPFX` flag. This flag allows `certutil.exe` to export certificates, potentially including private keys, into a Personal Information Exchange (PFX) file. This activity can be indicative of an adversary attempting to steal credentials or establish persistence by exporting legitimate certificates for later use in impersonation or decryption.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
Detects the execution of certutil.exe with the "-decode" or "-decodehex" flags to decode base64 or hex encoded files. This technique is commonly abused by attackers to deobfuscate and prepare encoded payloads for execution, often as part of defense evasion tactics.
Detects the execution of certutil.exe with the "-encode" flag to encode a file to base64, specifically when the file has a suspicious extension. This activity can be indicative of an adversary attempting to obfuscate malicious files or exfiltrate data.
Detects the execution of `certutil.exe` with the "-encode" flag to encode a file to Base64. This rule specifically triggers when the input file is located in potentially suspicious directories such as `AppData\Roaming\`, `Desktop\`, `Local\Temp\`, `PerfLogs\`, `Users\Public\`, `Windows\Temp\`, or `$Recycle.Bin`. This activity is often indicative of defense evasion, where attackers obfuscate malicious payloads to bypass security controls or hide their activities.
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
This rule detects potential obfuscated or stealthy PowerShell execution by identifying PowerShell commands that do not use the default 'powershell' or 'pwsh' executable names but still contain common PowerShell command-line arguments such as '-NoProfile', '-ExecutionPolicy', or 'Invoke-Expression'. It correlates these executions with user logon sessions to aid in attribution and threat hunting.
Detects the Koi Stealer macOS variant, an infostealer targeting cryptocurrency wallets and sensitive user data. This malware is linked to North Korean threat actors.
Detects a packed EDR Killer tool used by multiple ransomware groups like RansomHub, INC, and Medusa. This tool, often packed with HeartCrypt, is designed to disable various security products by loading a malicious driver.
Detects common JavaScript patterns used for reflective code loading and dynamic code execution. Adversaries use these techniques to obfuscate malicious code and evade static analysis by executing code from strings or other dynamic sources.
Detects PowerShell obfuscation techniques in process command lines, including encoded commands, IEX with string manipulation, and long command lines with string functions, indicating potential malicious activity. The rule specifically looks for the use of '-encodedcommand' or its short forms with long command lines, 'iex' or 'invoke-expression' combined with string manipulation (like '+', '-join', '[char]', 'frombase64string') or very long command lines, and unusually long command lines that also contain string manipulation functions ('-join', 'replace', 'split').
Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
KQL Query from file: Detect DeerStealer Delivered via Obfuscated .LNK
Page 65 of 81