Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects when common package management tools (npm, pip, nuget, python) spawn potentially malicious child processes such as cmd.exe, powershell.exe, curl.exe, or certutil.exe. This activity is a classic indicator of supply chain attacks where a compromised dependency or installation hook attempts to execute arbitrary commands or download secondary payloads on a developer or build machine.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Identifies the installation or enabling of the OpenSSH Server capability on a Windows system, which is rarely required on standard user workstations and can be used for persistence or remote access.
Detects the creation of various payload and configuration files (VBS, BAT, AHK, PS1, or files containing 'Subtitles') inside the 'Microsoft.WindowsSoundDiagnostics' directory, which is a known technique used by malware like AsyncRAT to evade detection.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects PowerShell or .NET code modifying ServicePointManager or certificate validation callbacks so later downloads accept untrusted certificates. This behavior is often associated with malware like InstallFix to bypass security measures during C2 communication or payload delivery.
Detects a script constructing a URL or request path from hostname, username, machine GUID, or volume serial information before downloading a second stage. This behavior is associated with the InstallFix malware.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Page 126 of 213