Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
This rule detects the execution of potentially malicious commands launched directly from the Windows File Explorer address bar. By analyzing DeviceProcessEvents, it identifies when explorer.exe spawns common command-line utilities (powershell.exe, cmd.exe, etc.) with arguments often associated with malicious activity, such as remote script downloads, encoded commands, or bypass flags.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects the PowerShell downloader stage of the abdrizak PostCSS typosquatting campaign. The malware decodes an AES-encrypted blob in the npm package and executes powershell with ExecutionPolicy Bypass targeting settings.ps1, or invokes curl.exe (from node.exe or powershell.exe) to download a payload from nvidiadriver.net disguised as a Windows driver update.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
This rule detects the execution of PowerShell or pwsh.exe with an encoded command. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for the '-EncodedCommand' or '-enc' parameter followed by a base64-encoded string of at least 20 characters.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.
Detects the execution of PowerShell with an encoded command flag (e.g., -EncodedCommand, -e, -ec) where the command string exceeds 200 characters. This pattern is commonly used to obfuscate malicious PowerShell scripts, payloads, or downloader cradles.
Detects the use of PowerShell commands that leverage 'Invoke-Expression' (IEX) in conjunction with 'Net.WebClient' or 'DownloadString' methods to download and execute code directly from the internet into memory.
Detects the creation of a scheduled task via schtasks.exe that involves PowerShell executing commands via IEX and IRM, a technique associated with the DeepLoad malware to maintain persistence.
This rule detects instances where Microsoft Teams (Teams.exe or ms-teams.exe) initiates a PowerShell process (powershell.exe or pwsh.exe) with command-line arguments typically associated with malicious activity, such as downloading content from the internet, executing encoded commands, or utilizing scripting shortcuts (e.g., IEX, curl). This behavior may indicate an attempt to achieve code execution through compromised collaboration tools.
Page 104 of 213