Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of common PowerShell cmdlets often associated with fileless malware execution, such as 'Invoke-Expression', 'IEX', or 'DownloadString', initiated by 'powershell.exe'. These patterns are frequently used to download and execute malicious payloads directly in memory, bypassing traditional disk-based scanning.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects the spawning of core Windows system processes (explorer.exe, svchost.exe, lsass.exe, winlogon.exe) by common script interpreters (powershell.exe, cmd.exe, wscript.exe). This pattern is often indicative of malicious activity, such as process hollowing, privilege escalation, or persistence mechanisms where an adversary abuses these interpreters to initiate or inject into critical system processes.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
This rule detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell. It specifically looks for multiple executions of these tools within a 5-minute window, originating from non-system accounts and not from standard Windows system directories. This behavior can indicate lateral movement or other malicious activity within a network.
Detects the execution of a PowerShell script named 'nm.ps1', which has been associated with the Seedworm threat group for staging purposes. This rule specifically looks for 'nm.ps1' within process command lines.
Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.
Detects post-compromise reconnaissance activity characterized by a rapid burst of native Windows tool executions (whoami, net, ipconfig, systeminfo, nltest, wmic) or PowerShell commands used for discovery. The rule triggers when a threshold of 3 distinct reconnaissance activities is met within a 30-minute window on a single device, helping to identify potential lateral movement or internal network mapping by an adversary.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects ClearFake PowerShell stager using 'iex' (Invoke-Expression) and 'irm' (Invoke-RestMethod) with '-UseBasicParsing'. This combination is often used by malware to download and execute scripts from the internet, bypassing more robust parsing mechanisms.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.
Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.
This rule detects the creation of common reconnaissance and shell utilities (whoami.exe, hostname.exe, ipconfig.exe, cmd.exe, powershell.exe) by the IIS worker process (w3wp.exe) on Windows systems. This activity is often indicative of a web application compromise, such as a SharePoint vulnerability (e.g., path traversal), where an attacker leverages the web server to execute system commands for discovery or further exploitation. The rule specifically targets Security Event ID 4688 (process creation) and filters for processes spawned by w3wp.exe.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Page 123 of 213