Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the Microsoft Management Console (mmc.exe) spawning PowerShell with command-line arguments indicative of fileless execution, specifically using 'IEX' and 'DownloadString' or 'Net.WebClient' to retrieve and execute code from a remote location.
Detects collection of event log size, retention, record count, and audit policy categories to understand defensive visibility. This rule specifically looks for the execution of 'powershell.exe' with 'Get-WinEvent -ListLog Security' or 'auditpol.exe' with '/get /category' command-line arguments.
Detects instances where FFmpeg media processing tools (ffmpeg, ffprobe, ffmpegthumbnailer) spawn interactive shell processes (bash, sh, dash, zsh, cmd.exe, powershell.exe, pwsh.exe). This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects common shell and utility processes spawning as children of the AutoGen Studio process, indicating potential remote code execution via the AutoJack exploit chain.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
This rule detects indicators of the 'RoguePlanet' exploit, which leverages ISO image mounting to stage malicious files. It monitors for the execution of Windows Error Reporting (wermgr.exe) from virtual CD-ROM devices, unauthorized use of PowerShell to mount DiskImages or VHDs, and the creation of specific filesystem paths (RP_<UUID> directories) commonly associated with RoguePlanet exploit activity.
Detects anomalous activity involving the Windows Error Reporting service executable, wermgr.exe. This includes the suspicious creation of files within temporary directories that match known junction-based exploitation techniques, the creation of a 'wdtest_temp' subdirectory (often used as a working directory in exploit staging), and the execution of wermgr.exe from a path other than the expected Windows System32 directory.
This rule detects high-frequency file creation events where files are named with potential UUIDs within subdirectories of the 'Temp' folder matching the 'RP_' pattern. This activity is indicative of automated staging or data manipulation by a user-mode process, filtering out activity from system-level accounts.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.
This rule detects the creation of local user accounts using administrative tools such as 'net.exe', 'net1.exe', 'powershell.exe', or 'pwsh.exe'. It monitors command-line arguments indicative of account creation (e.g., 'user /add', 'New-LocalUser') and excludes legitimate parent processes commonly associated with administrative activity, such as explorer.exe or services.exe, to reduce noise.
Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.
Detects instances where Node.js (node.exe) or the Node Package Manager (npm.exe) process initiates common command-line shells (cmd.exe, powershell.exe) or network utility tools (curl.exe). This behavior is often associated with software supply chain attacks, exploitation of web applications, or malicious post-exploitation activity where Node-based environments are leveraged to execute system commands or download external payloads.
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects Microsoft Outlook spawning a command-line interpreter (cmd.exe or powershell.exe) followed by a network connection originating from that interpreter within a 5-minute window. This behavior is highly suspicious and often indicative of malicious macro execution or exploit delivery via email attachments leading to command-and-control activity.
Detects instances where Node.js (node.exe) or the Node Package Manager (npm.exe) process initiates common command-line shells (cmd.exe, powershell.exe) or network utility tools (curl.exe). This behavior is often associated with software supply chain attacks, exploitation of web applications, or malicious post-exploitation activity where Node-based environments are leveraged to execute system commands or download external payloads.
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects PowerShell or command-line modification of Defender real-time monitoring immediately before ransomware activity. This rule specifically looks for commands that disable real-time monitoring within Microsoft Defender.
Page 108 of 213