Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
This rule detects PowerShell commands or script block executions involving the creation of desktop shortcuts associated with the VILE ransomware decryptor. The rule specifically looks for the usage of WScript.Shell, the -NoProfile flag, and references to 'vile_Decryptor' or 'vile_icon.ico' in the command line or script content.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Detects the execution of 'tango13.ps1', a PowerShell payload associated with the Iranian APT group MuddyWater (also known as Seedworm or APT33), which has been observed being dropped via Microsoft Teams.
This rule detects the execution of processes associated with VMware or suspicious files mimicking legitimate VMware components, particularly when spawned from web servers (w3wp.exe) or command-line interpreters (cmd.exe, powershell.exe). It monitors for specific file names and paths that may indicate persistence, lateral movement, or evasion attempts involving VMware-related binaries or configurations.
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe, pwsh.exe). This behavior is highly suspicious as it often indicates a web application compromise or exploit attempt where an adversary has gained remote code execution.
This rule detects potential web shell activity on Windows IIS servers by monitoring for two suspicious behaviors: the w3wp.exe process spawning shell processes (cmd.exe or powershell.exe) and the creation or modification of .aspx files within common web root directories (\wwwroot\, \inetpub\). These are common indicators of web shell installation and subsequent remote command execution.
Detects the execution sequence associated with TonRAT malware, including the launching of PowerShell from explorer.exe via malicious LNK files (often disguised as photo or image files) and the subsequent execution of a node.exe process from user-writable directories such as AppData or Temp.
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
Detects potentially malicious activity involving the node.exe process. The rule identifies suspicious parent processes (PowerShell, cmd.exe, explorer.exe, wscript.exe), execution from non-standard user-writable directories (e.g., AppData, Temp), and network connections over non-standard C2 ports typically associated with TonRAT behavior.
Detects the loading of amsi.dll in conjunction with command-line arguments that reference sensitive APIs often used to patch or disable the Antimalware Scan Interface (AMSI), such as VirtualProtect, GetProcAddress, or BCrypt-related functions.
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
Detects taskkill, PowerShell, Windows Management Instrumentation or command-shell activity that attempts to terminate Discord. This activity is often seen with stealers like VVS Stealer which stops active Discord processes before replacing application support files with injected JavaScript.
Identifies potential DLL sideloading by detecting a signed process loading an unsigned or low-prevalence DLL from its own directory, followed by that same process spawning a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) within a one-hour window.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Page 124 of 213