Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Detects activity mentioned in Operation Wocao report
Detects presence of a potentially xor encoded powershell command
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block
This analytic detects processes making DNS queries to tinyurl.com from suspicious file paths. URL shorteners like tinyurl.com are often used by adversaries to hide malicious destinations for phishing, malware distribution, or command and control (C2). While tinyurl.com is a legitimate service, its use by non-browser processes or scripts, especially from locations like AppData, Temp, or ProgramData, is highly suspicious. Further investigation into the process, its execution context, and the resolved domain is recommended to assess intent and risk.
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Detects potential powershell Base64 encoded Shellcode
Detects activity mentioned in Operation Wocao report
Detects all Emotet like process executions that are not covered by the more generic rules
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
Detects potential CommandLine obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects usage of "xor" or "bxor" in combination of a "foreach" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
Page 70 of 81