Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects attempts to disable Windows Defender features, including real-time, behavior, and script scanning monitoring, as well as modifications to the 'DisableAntiSpyware' registry key, disabling system recovery via bcdedit, or execution of common scripts used to disable Windows Defender.
This rule detects instances where common web browsers (Chrome, Edge, Firefox, IE, Brave, Opera) spawn common administrative or scripting shells (PowerShell, CMD, mshta, wscript, cscript). This pattern is frequently indicative of drive-by downloads or malicious file execution triggered by social engineering, where an attacker leverages the browser process to spawn execution environments to run malicious scripts or payloads.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.
Detects suspicious process creations (PowerShell, Cmd, Mshta, Wscript) originating from web browsers, explorer.exe (likely from the Run dialog), or rundll32.exe. This pattern is often associated with social engineering attacks like 'ClickFix' where users are tricked into pasting malicious commands.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the loading of System.Management.Automation.dll by processes that are not standard PowerShell executables (powershell.exe, pwsh.exe, powershell_ise.exe). This behavior is indicative of in-process PowerShell execution, potentially leveraging techniques like SHEETCREEP's RunspaceFactory.CreateRunspace(). The rule specifically looks for processes loading this DLL from suspicious paths like AppData or if the process is 'vaultsvc.exe', and further filters out cases where a powershell.exe child process is spawned, to reduce false positives.
Detects a multi-stage infection chain associated with the TONResolver campaign where PowerShell is used to execute a Node.js-based RAT payload from a non-standard location in AppData\Local\Nodejs. This pattern monitors for the parent-child relationship where PowerShell launches a specific node.exe instance containing JavaScript file execution flags.
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.
Detects anomalous PowerShell process execution by monitoring for indicators of obfuscation, use of download cradles, and execution from suspicious parent processes. This detection specifically aligns with techniques associated with the Millenium RAT C++ v4.x stagers, flagging processes that exhibit multiple risk indicators simultaneously.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects the execution of sensitive command-line tools or environment variables (e.g., AWS CLI, MCP tools, environment secrets) triggered by AI-based development assistants such as Claude, Cursor, or Windsurf. This behavior may indicate an attacker abusing the permissions or capabilities of an AI coding assistant to perform unauthorized cloud discovery or credential access.
This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.
Detects when Minecraft-related clients (e.g., Lunar Client, generic Java Minecraft) launch suspicious child processes such as command-line utilities (cmd.exe, powershell.exe, curl.exe) often associated with malicious post-exploitation activity or credential harvesting.
Detects instances where the AnyDesk remote support application spawns suspicious child processes or administrative utilities. This rule specifically alerts on AnyDesk launching interpreters such as PowerShell, CMD, WScript, or utility binaries like dllhost, regsvr32, mshta, and rundll32, or when processes are executed in the context of the SYSTEM account (UserSid S-1-5-18). Such behavior is a common indicator of unauthorized remote access or post-exploitation activity.
Detects suspicious behavior originating from OpenVPN processes, including spawning command-line interpreters (cmd, powershell, etc.), utilization of server-pushed configuration directives that trigger script execution (e.g., up, down, or route-up hooks), and the creation of scripts or executables within temporary directories.
Page 100 of 213