Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects base64 encoded listing Win32_Shadowcopy
Detects all Emotet like process executions that are not covered by the more generic rules
Detects commands used by Turla group as reported by ESET in May 2020
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations
Detects Obfuscated use of stdin to execute PowerShell
Detects suspicious encoded character syntax often used for defense evasion
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the execution of certutil with certain flags that allow the utility to download files.
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Detects Obfuscated Powershell via use MSHTA in Scripts
Ping Hex IP
Sigma
Detects a ping command that uses a hex encoded IP address
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Page 74 of 81