Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
184 detections
Filters
Last updated
All Time
Detection languages
71
70
10
8
8
Contributors
47
32
24
15
10
Categories
137
102
96
51
10
Platforms
163
12
11
9
1
Products / Services
49
43
31
17
13
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
3
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Detects obfuscated shell command execution on VMware ESXi as hunted by CrowdStrike, where attackers hide esxcli commands (e.g. syslog config reset for log evasion, vm process list for recon) behind decode-and-execute wrappers such as printf hex/octal escapes, awk BEGIN blocks (chr/ord/xor/zero-width-unicode/morse/binary decoders), python -c chr() reconstruction, sed/od character-reversal ciphers, and $TERM/$SHELL substring reassembly, frequently invoking /usr/lib/vmware/busybox/bin/busybox or staging output in hidden /vmfs/volumes//.sys files before piping the reconstructed command into sh.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
Detects suspicious PowerShell command execution patterns commonly associated with malicious activities, including base64-encoded commands, download cradles used to fetch external content, and various obfuscation techniques like character concatenation or backtick escaping to hide malicious intent.
This rule detects potentially malicious PowerShell activity by identifying common obfuscation patterns, including encoded commands (Base64), IEX (Invoke-Expression) download cradles, and execution with hidden windows. It triggers when multiple suspicious flags are present or when an unusually long encoded blob is identified in script blocks, command lines, or process arguments.
Detects instances where Windows Explorer launches command interpreters (cmd.exe, powershell.exe, wscript.exe, or mshta.exe) with suspicious leading whitespace in the command-line arguments. This behavior is often associated with obfuscation techniques intended to bypass command-line monitoring or security filters.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
This rule detects potentially malicious usage of msiexec.exe where the command line contains obfuscation techniques such as excessive spacing, Unicode character substitution, or suspicious case variations. It specifically looks for activity initiated by common shell processes like explorer.exe or cmd.exe that involves the /package argument or URL-based loading, which is a common indicator of MSI-based payload delivery.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
This rule detects potentially malicious usage of msiexec.exe where the command line contains obfuscation techniques such as excessive spacing, Unicode character substitution, or suspicious case variations. It specifically looks for activity initiated by common shell processes like explorer.exe or cmd.exe that involves the /package argument or URL-based loading, which is a common indicator of MSI-based payload delivery.
Detects the execution of bash commands containing base64 decoding instructions, often used by adversaries to decode and execute obfuscated scripts or payloads. The rule specifically looks for command lines invoking base64 along with keywords like 'echo' or 'reCAPTCHA', which are commonly associated with malicious droppers or phishing-related scripts.
This rule detects PowerShell commands that attempt to reassemble a Base64-encoded payload from multiple concatenated variable fragments. It specifically looks for patterns where filler characters ('*' or '?') are stripped from the payload before it is passed to the [Convert]::FromBase64String method. This technique is commonly used to evade static string analysis and signature-based detection.
Detects the execution of PowerShell scripts that utilize large arrays of negative integers to reconstruct and dynamically execute code via the [scriptblock]::Create method. This technique is commonly used to obfuscate malicious payloads such as downloaders or API calls from static analysis.
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Detects the execution of PowerShell commands that utilize a combination of 'iex' (Invoke-Expression) and obfuscated strings typical of download cradles. The rule looks for escaped double quotes inside the command line and specific regex patterns that match common obfuscation techniques used to hide malicious URLs or script components.
Page 1 of 9