Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where ConfigurationRemotingServer.exe spawns known living-off-the-land binaries (LOLBINs) or executes binaries from suspicious paths. This behavior is indicative of abuse of the WinGet DSC WindowsProcess resource block to execute arbitrary commands.
Detects execution of ConfigurationRemotingServer.exe as a child process of winget.exe. This activity is indicative of the DSCourier technique, which abuses the Windows Package Manager Desired State Configuration (DSC) engine to execute arbitrary PowerShell scripts embedded in configuration files, bypassing standard PowerShell invocation monitoring.
Detects winget.exe executing the 'configure' subcommand, which subsequently launches 'ConfigurationRemotingServer.exe'. This pattern is associated with potential abuse of Windows Desired State Configuration (DSC) to execute arbitrary code or scripts embedded within DSC configuration files, bypassing standard PowerShell execution monitoring mechanisms.
Detects the execution of discovery commands (e.g., whoami, tasklist, net user) spawned from the OneDrive.Sync.Service.exe process, consistent with behavior from the SPECTRALVIPER XGU module.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects instances where wscript.exe or cscript.exe (commonly used to execute JSE files) spawns powershell.exe with command-line arguments indicative of the Kimsuky NUKESPED malware loader. The detection specifically looks for the combination of hidden window, base64 decoding flags, and execution from or manipulation of paths within C:\ProgramData.
Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
Detects malicious dropper behavior involving batch files spawning hidden PowerShell processes to download components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) to temporary directories. The rule further tracks the execution of the dropped fltMC.exe and the creation of the associated DLL/binary files, which is indicative of JFMBackdoor DLL side-loading.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects PowerShell activating the internal Store install-control class required for UnCanny coercion. This technique is associated with the UnCanny coercion method, which leverages a COM object to achieve privilege escalation or other malicious activities.
Detects the execution of PowerShell via Command Prompt (cmd.exe) using hidden window arguments to download files from external sources or temporary directories, often associated with stages of malware delivery or post-exploitation activity.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Detects the RemotePC RMM component (rpccmdhost.exe) being used to spawn PowerShell processes with suspicious command-line arguments. The rule specifically looks for evidence of hidden PowerShell execution designed to bypass TLS certificate validation and download external scripts or stagers from a known C2 IP address associated with ROOTBOY activity.
Detects the use of reg.exe to add a 'NvmProtocal' entry to the Windows Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). This behavior is indicative of a backdoor establishing persistence by scheduling the execution of node.exe with a hidden PowerShell window upon user logon.
Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.
This rule detects potentially suspicious process activity where unknown or infrequently seen processes spawn common script interpreters such as cmd.exe, powershell.exe, wscript.exe, or others. This behavior often indicates an attempt to execute malicious commands or scripts as part of a post-exploitation or persistence mechanism.
Page 110 of 213