Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, such as modifying AmsiUtils, AmsiScanBuffer, or related reflection-based obfuscation in process command lines.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects instances where msiexec.exe spawns suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, or other common LOLBins, often associated with LegionLoader activity. The rule looks for suspicious command-line arguments (e.g., silent install flags, AppData paths, or specific artifacts like xupdate.bat or data.dat) indicative of malicious MSI-based proxy execution.
Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.
Detects the execution of cloud CLI tools (aws, curl) or shell interpreters (bash, sh, cmd, powershell) triggered by development-related processes like Node.js, VS Code, or Amazon Q. This pattern is indicative of potential command-and-control activity or credentials theft occurring via compromised developer environments.
Detects anomalous child process execution by RustDesk, including shell spawning (cmd, powershell, etc.) or internal session-related process manipulation which may indicate unauthorized remote control, session hijacking, or exploitation of proof-of-concept permission bypass tools.
Detects evidence of BeepRAT malware performing in-memory AMSI or ETW bypass techniques via process command line arguments (e.g., AmsiUtils, AmsiScanBuffer, EtwEventWrite) originating from volatile directories like AppData or Temp, followed by the execution of suspicious processes (PowerShell, csc.exe, msbuild.exe) within a 5-minute window on the same host.
Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects Visual Studio Code spawning common command-line shells or interpreters (cmd.exe, powershell.exe, python, etc.) with suspicious command-line arguments, such as network download utilities (curl, wget, Invoke-WebRequest) or potentially malicious obfuscated/long arguments, which may indicate developer environment exploitation or software supply chain attacks.
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects instances of PowerShell being launched directly by explorer.exe. This activity is a known indicator of 'ClickFix' or similar social engineering campaigns, where users are instructed by a deceptive website or lure to copy and paste malicious PowerShell commands into the Windows Run dialog or the File Explorer address bar to execute code.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
Detects a logon task or Run value that starts PowerShell with a network retrieval expression rather than a local administrative script. This rule specifically looks for modifications to registry run keys that include PowerShell or pwsh commands attempting to download content using methods like Invoke-WebRequest, DownloadString, DownloadFile, Net.WebClient, or curl.
Detects execution of a Brazilian invoice-themed batch file that launches hidden PowerShell and stages the banking trojan. This rule specifically looks for process creation events where the executable is 'cmd.exe' or 'powershell.exe' and the command line contains 'Consultar_NF-e.bat' or similar variations, indicating the use of a batch file named after a Brazilian invoice.
Identifies instances where a user account established an interactive logon session from a known RedVDS IP address and subsequently executed PowerShell commands containing download patterns (Net.WebClient or DownloadString), indicative of secondary payload retrieval.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Page 114 of 213