Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects potential command-line obfuscation using Unicode characters. Adversaries may use these characters to evade detection by security tools that do not properly normalize or interpret them, making the command-line arguments difficult to analyze or signature.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
Yara rule that detects NoodRAT backdoor.
Detects PowerShell commands attempting to load .NET assemblies reflectively using Base64 encoded strings. This technique is often used by adversaries to execute malicious code in memory, evading disk-based detections.
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
This rule detects PowerShell execution where the command line contains Base64 encoded strings that decode to 'Invoke-' keywords. It specifically looks for both UTF-8 and UTF-16 Little Endian (LE) encodings of 'Invoke-' when PowerShell or pwsh.exe is executed with the '-e' (encoded command) flag. This technique is commonly used by adversaries to obfuscate malicious PowerShell commands.
Detects when a password-protected ZIP archive is opened or extracted on a Windows system. This is identified by EventID 5379 from the Security log, specifically looking for 'Microsoft_Windows_Shell_ZipFolder:filename' in the TargetName field. The rule filters out events originating from '
Temporary Internet Files\Content.Outlook' to reduce false positives.
Temporary Internet Files\Content.Outlook' to reduce false positives.
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
Detects potential suspicious execution of a process from a GUID-like folder name located in a suspicious temporary directory, a technique observed in IcedID attacks. This rule is designed to identify uncommon and potentially malicious activity stemming from such folders.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the usage of the `base64` utility on macOS to decode arbitrary base64-encoded text. This activity can be indicative of an adversary deobfuscating malicious content, such as scripts or payloads, that were previously encoded to evade detection.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.
Detects the execution of PowerShell scripts obfuscated using techniques associated with Invoke-Obfuscation, specifically when launched via rundll32.exe and shell32.dll. This method is often used by adversaries to evade detection and execute malicious PowerShell code.
Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.
Page 77 of 81