Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
Detects instances where browser processes (Chrome, Edge, Firefox) directly spawn PowerShell or MSHTA. This is a behavioral indicator of the 'ClickFix' social engineering technique, where victims are tricked into copying and pasting malicious commands into a terminal, often presented as 'fixes' for fake browser error messages or verification prompts.
Detects the execution of a Nuitka-compiled Python RAT (chost.exe) associated with the PostCSS typosquatting campaign. The rule identifies this malicious binary when spawned by wscript.exe, powershell.exe, or node.exe from a location outside of C:\Windows\, followed by network communication to known campaign-associated C2 infrastructure.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript, PowerShell) to launch the Microsoft Build Engine (MSBuild) for potentially malicious code execution.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
This rule detects instances where Microsoft Management Console (mmc.exe) spawns a hidden PowerShell process that attempts to execute commands using 'IEX' (Invoke-Expression) combined with 'DownloadString' or 'Net.WebClient'. This pattern is commonly associated with malicious activity, such as downloading and executing payloads from a remote source, often to evade detection.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects PowerShell executing 'Add-AppxPackage -Register' with a UNC path, which is a core primitive of the UNCanny InstallService coercion attack. This indicates an attempt to register a loose-file AppX package from a network share.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
This rule detects various activities related to the installation, configuration, and execution of OpenSSH on Windows systems. It looks for processes adding the OpenSSH server capability, creating the sshd service, generating SSH keys, and the execution of the sshd.exe process. It also includes a specific hash for a known malicious SSH artifact and firewall rule additions containing 'SSH'.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
This rule detects potentially malicious process chains involving PowerShell and Node.js. It specifically flags cases where PowerShell launches PowerShell or Node.js with command lines containing suspicious file patterns (e.g., .lnk masquerading as images) or when Node.js is executed from PowerShell in user-writable directories (e.g., AppData, Temp) with command lines referencing known malicious domains.
Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects execution patterns associated with the Gamaredon (Shuckworm) group's Ptero-family of malware. It specifically monitors for encoded PowerShell commands, the use of Invoke-Expression, and the execution of mshta.exe or wscript.exe spawned by Office applications or email clients, which is characteristic of Gamaredon's HTML smuggling and malicious document delivery techniques.
This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.
Page 111 of 213