Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects the execution of PowerShell commands or script blocks that contain specific de-obfuscation patterns associated with the ErrTraffic/ClickFix malware. It looks for the presence of '-bxor' and '[convert]::ToInt32' within PowerShell command lines or script blocks, indicating an attempt to decode obfuscated content.
Detects the ClickFix clipboard execution (Get-Clipboard or iex) triggered from explorer.exe, specifically leading to the download of the Matanbuchus DLL.
Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.
Detects PowerShell IEX download cradle used for fileless execution
Detects instances where the RustDesk remote access application spawns common system administrative or command-line tools. This behavior is highly indicative of potential abuse of remote desktop software by an attacker to maintain persistent control, execute commands, or perform reconnaissance on a compromised system.
This rule detects various reconnaissance techniques commonly used to identify network resources, including the execution of SoftPerfect Network Scanner (or renamed binaries), the creation of 'delete.me' files used by SoftPerfect to probe share permissions, the usage of the 'Invoke-ShareFinder' PowerShell script, and the enumeration of network shares using 'net.exe' initiated from PowerShell.
Detects anomalous child process creation or .lnk file interaction by the LunarClient process. This rule monitors for indicators of potential supply chain compromise or malicious activity where the gaming client spawns shells, scripting interpreters, or network utilities, or generates shortcut files to facilitate further execution.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes. This behavior is indicative of an exploit targeting the OpenVPN Connect 'echo' script ACE vulnerability, where a malicious VPN server pushes configuration directives (e.g., script.win.user.disconnect) that trigger arbitrary command execution on the client, potentially bypassing script permissions.
Detects instances where the RustDesk remote control application spawns suspicious child processes, such as command interpreters or scripting utilities. This behavior is indicative of a permission bypass exploit, where an attacker leverages an existing authorized remote session to gain interactive command-line access or execute unauthorized commands on the target host.
Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.
This rule detects potentially malicious activity involving the WinRAR utility. It monitors for WinRAR creating files in Windows Startup folders, dropping files in specific ProgramData subdirectories often associated with staging malicious payloads, and spawning suspicious child processes such as command shells, scripting engines, or HTML applications.
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
Page 115 of 213