Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects wscript.exe executing PowerShell to run a script dropped into the C:\Temp directory. This behavior is consistent with common JScript dropper infection chains, such as Amadey or StealC, which use WScript to decode and execute Base64 payloads from temporary files using hidden windows and bypassed execution policies.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects the GitLab Runner process (gitlab-runner-windows-amd64.exe) spawning PowerShell with command-line arguments indicative of a C2 framework or manual operator interaction, such as '-NoProfile', '-NonInteractive', '-ExecutionPolicy Bypass', and '-Command'. The rule specifically targets instances where these processes are executed under the SYSTEM account, a behavior commonly associated with exploiting CI/CD runners for persistent command execution.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
This rule detects attempts to disable PowerShell history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle' set to 'SaveNothing'. This technique can be used by adversaries to hinder forensic analysis and hide their command execution history.
Detects the execution of known offensive security toolkits commonly used for Active Directory enumeration and exploitation, including Impacket (mini_imp) and BloodHound/SharpHound. The rule monitors for command-line arguments and file creation artifacts associated with these tools.
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects instances where ColdFusion service processes or IIS worker processes (w3wp.exe) spawn common command-line interface tools or system enumeration utilities. This activity often indicates post-exploitation behavior, such as a web shell being used to execute commands, perform system discovery, or establish persistent re-access after initial remediation.
Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Detects a batch or PowerShell loader reading 'msedge.txt' from a writable path (Temp, AppData, Downloads, ProgramData) and treating its content as encoded executable data. This behavior is indicative of the Banana RAT malware.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' (Invoke-RestMethod) fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex' (Invoke-Expression). This pattern is indicative of the GLASSWORM malware's initial payload delivery mechanism.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Page 112 of 213