Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
Detects the use of "VMwareToolBoxCmd.exe" with the "script" and "set" flags to configure a script to run when a VM state changes. The rule specifically looks for scripts located in suspicious paths like temporary directories or Windows system directories, which could indicate an attempt at persistence or privilege escalation within a virtualized environment.
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
Detects the execution of 'curl.exe' with the '--insecure' flag or its shorthand '-k'. This flag tells curl to proceed with insecure SSL connections and transfers, which can be used by adversaries to bypass certificate validation when communicating with command and control servers or exfiltrating data, especially if they are using self-signed certificates or have intercepted traffic.
This rule detects attempts to change the password for the currently logged-on user using the 'ksetup.exe' utility. The detection specifically looks for the execution of 'ksetup.exe' with the '/ChangePassword' command-line argument. This activity could indicate an attacker attempting to modify user credentials on a compromised system.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command line, which could indicate a suspicious activity. This pattern is often observed in scripts attempting to execute commands via Windows Script Host (WSH) objects.
Detects PowerShell scripts attempting to import modules from suspicious directories such as temporary folders or publicly accessible user directories. This behavior can indicate an attempt to execute malicious code or evade detection by using non-standard module locations.
Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.
Detects the creation of a process named 'rasdial.exe'. This executable is used to establish and manage dial-up network connections, but can also be abused by adversaries for various purposes, including establishing C2 communication or exfiltration channels, or for defense evasion by creating unexpected network connections.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
Detects suspicious execution of 'sysprep.exe' where the command line includes a path within the 'AppData' folder. This behavior has been observed in malware like Trojan Syndicasec, as detailed in Symantec's Thrip report.
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
This rule detects the execution of PowerShell scripts where the script content is provided via a redirected input stream. This technique is often used by adversaries to execute malicious PowerShell code without writing it to a file, which can help evade detection. The rule specifically looks for PowerShell or pwsh executables being run with a command line containing '- <', which signifies input stream redirection.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Detects java process spawning suspicious children
Detects usage of "xterm" as a potential reverse shell tunnel
Detects triggering of AMSI by Windows Defender.
Detects processes creating temp files related to PCRE.NET package
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Detects processes loading modules related to PCRE.NET package
Page 153 of 155