Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell with an encoded command flag (e.g., -EncodedCommand, -e, -ec) where the command string exceeds 200 characters. This pattern is commonly used to obfuscate malicious PowerShell scripts, payloads, or downloader cradles.
Detects the execution of PowerShell or PWSH attempting to download external content via web-oriented cmdlets (Net.WebClient, Invoke-WebRequest, Start-BitsTransfer) using typical obfuscation flags (e.g., -WindowStyle Hidden).
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
This rule detects PowerShell activity where scripts or commands are used to interact with the Windows clipboard, such as retrieving text or data. This is often indicative of reconnaissance or data theft attempts, where an adversary aims to capture credentials, secrets, or sensitive information stored in the clipboard by a user.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launch suspicious child processes often associated with malicious command execution, such as command shells, scripting interpreters, or system utilities.
This rule detects PowerShell activity where scripts or commands are used to interact with the Windows clipboard, such as retrieving text or data. This is often indicative of reconnaissance or data theft attempts, where an adversary aims to capture credentials, secrets, or sensitive information stored in the clipboard by a user.
Detects execution of the EDRUnChoker remediation tool, useful for situational awareness. This rule specifically looks for the command line containing 'Install-EdrChokerWmiDefense.ps1', indicating the execution of a PowerShell script related to EDR evasion or manipulation.
Identifies rapid creation of multiple QoS policies, matching EDRChoker's behavior iterating through process lists. This rule detects when three or more QoS policies are created within a one-minute window on a single device, indicated by the execution of 'New-NetQosPolicy' via PowerShell.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Shadow Delete Activity
YARA-L
Detects attempts to delete shadow copies or disable system recovery using common administrative tools.
Detects post-compromise Active Directory reconnaissance activities using net.exe or wmic.exe to enumerate domain users, groups, computers, and sessions. The rule identifies anomalous behavior by monitoring for at least 3 distinct reconnaissance categories triggered by common scripting interpreters (PowerShell, cmd, pythonw, or node.exe) within a 5-minute window.
Detects a script or document containing PowerShell commands for web retrieval (Invoke-WebRequest or DownloadString) that specifically targets an .rtf file from a URL. This pattern is indicative of a staging mechanism for malware like Animateclipper.
Detects PowerShell referencing AMSI internals, reflection, or amsiInitFailed before executing a downloaded stage. This rule specifically looks for PowerShell processes executing commands that contain keywords related to AMSI bypass techniques, such as 'AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'amsiContext', 'GetField', combined with 'SetValue', 'Reflection', or 'NonPublic'. This indicates an attempt to modify AMSI's behavior in memory.
This rule detects suspicious PowerShell execution patterns involving scripts or payloads stored within specific directory paths (ProgramData\WC3\ or ProgramData\wt1). It flags instances where PowerShell commands include reflective loading techniques ('IEX' or 'Invoke-Expression') while referencing files in these paths, which is often associated with fileless malware execution or malicious loaders.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects suspicious child processes spawned from AutoGen Studio or mcp.py Python processes, which could indicate a WebSocket command injection vulnerability (AutoJack - CWE-78). The rule looks for common shell or command execution binaries and keywords in the process command line.
Detects potential DCOM lateral movement by identifying svchost.exe spawning DCOM host processes (mmc.exe, mshta.exe, wmic.exe) with the '-Embedding' argument, followed by these DCOM host processes spawning command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern is indicative of adversaries leveraging DCOM for remote code execution and subsequent shell access.
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
Page 120 of 213