Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.
This rule detects a sequence of events where a new local account is created on a device using common administrative commands (net user, PowerShell New-LocalUser), followed within 60 minutes by the execution of known offensive security tools or frameworks such as Impacket, NetExec, CrackMapExec, Chisel, or Havoc agent on the same device. This pattern is indicative of potential unauthorized system access, staging of persistence mechanisms, or active reconnaissance activities.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects reconnaissance activity where PowerShell scripts named 'lightlife.ps1' or 'Update.ps1' execute common Windows system information discovery commands such as systeminfo, whoami, hostname, and wmic. This activity is indicative of the Lightlife RAT performing post-exploitation host enumeration.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. The detection monitors for the presence of specific keywords and method calls in script content, such as 'AmsiUtils', 'amsiInitFailed', and reflection-based attempts to modify memory buffers used by AMSI to scan for malicious scripts.
Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.
Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
Detects reconnaissance activity where PowerShell is used to enumerate installed software by querying Windows registry uninstall keys (HKLM and HKCU) via cmdlets such as Get-ItemProperty, Get-StartApps, or Get-AppxPackage. This behavior is associated with the ROOTBOY/Prinz Eugen campaign, typically performed as a precursor to ransomware deployment.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Detects the use of PowerShell to initiate web requests to Storj-hosted URLs (link.storjshare.io or .storj.io), utilizing either the WebClient class or the Invoke-WebRequest cmdlet. This behavior is associated with the REF8372 OXLOADER malvertising campaign, where PowerShell scripts are used to download malicious payloads.
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects node.exe spawning PowerShell, a technique used by the MuddyWater (also known as Seedworm) threat group for post-exploitation reconnaissance, staging, and screenshot capture. This rule specifically looks for the 'node.exe' process initiating 'powershell.exe' or 'pwsh.exe'.
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Page 119 of 213