Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
This rule detects inbound Remote Desktop Protocol (RDP) connections (ports 3389, 3390, 3391) that are initiated by common scripting engines such as wscript.exe, cscript.exe, or powershell.exe. This behavior can be indicative of post-exploitation activity where an attacker uses scripts to establish remote access.
Detects pythonw.exe execution specifically invoked by cmd or powershell from the AppData directory. This behavior is often associated with malicious Python loaders used in social engineering campaigns leveraging AI hype.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
Detects PowerShell process executions that include the string 'bubble' in combination with string manipulation functions ('replace', 'split') or a campaign-specific function ('otidiform'). This pattern is indicative of attempts to deobfuscate PowerShell commands, often used by adversaries to hide malicious code.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.
Identifies string splitting techniques used in Dropping Elephant downloaders to evade static PowerShell logging. The rule specifically looks for obfuscated substrings like 'iw''r', 'g''c''i', 'r''e''n', 'c''p''i', and 'g''cm sch' within PowerShell command lines.
Detects PowerShell command lines attempting to disable AMSI (Antimalware Scan Interface) by leveraging 'AmsiUtils' and 'amsiContext'. This technique is often used by adversaries to evade security controls that rely on AMSI for script scanning.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Page 121 of 213