Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.
Detects instances where development IDEs (VS Code or Cursor) spawn suspicious child processes such as command shells (cmd, powershell, bash) or network utilities (curl, wget). The detection logic focuses on common command line patterns associated with IDE tasks or potential malicious activity.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects PowerShell-based malware stagers used by ErrTraffic ClickFix campaigns that download and execute second-stage payloads using encoded commands and common download cradles. It also detects certutil.exe used for decoding.
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) act as the parent process for scripting interpreters such as PowerShell or cmd.exe. This behavior is highly irregular for standard browsing activity and is often indicative of malicious code execution, such as a drive-by download or browser exploit triggering secondary payload execution.
Detects the execution of PowerShell with suspicious command-line arguments, including obfuscation techniques like base64 encoding, attempts to hide the console window, and strings associated with Pterodo-related tools or backdoors.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
Detects the execution of PowerShell with encoded commands initiated by common office applications (e.g., WinWord, Excel) or scripting engines (e.g., wscript, mshta). The rule specifically targets command lines longer than 200 characters that are not digitally signed by Microsoft, often indicating obfuscated malicious payloads intended to evade detection.
Detects a browser launching cmd.exe or PowerShell immediately after a user visits or downloads content presented as an AI coding assistant installer. This rule specifically looks for process creation events where a browser (Chrome, Edge, Firefox) is the parent process, and the child process is a command shell (cmd.exe, powershell.exe, pwsh.exe), with the command line containing keywords related to 'claude', 'install', 'setup', 'copy paste', 'mshta', or 'download'.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
This rule detects potential data exfiltration activity where PowerShell is used to compress files followed by an outbound network connection to a known C2 IP address and port. It also monitors for direct outbound connections from PowerShell involving suspicious keywords indicative of data staging and exfiltration such as 'Compress-Archive', 'client.zip', and 'UPLOAD'.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
Page 101 of 213