Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Detects browser network events fetching secondary stage loaders from api.wizzleticks.com, specifically when initiated by cmd.exe, powershell.exe, or mshta.exe. This indicates a potential supply chain attack where a legitimate process is used to download and execute malicious content.
Correlates mshta.exe (post-HTA load) spawning PowerShell to execute secondary stages like the .vmxx shellcode, as observed in Operation XENOFISCAL.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects PowerShell launched with hidden or non-interactive options and encoded, compressed, or character-reassembled content. This behavior is often indicative of malicious activity, as adversaries use these techniques to evade detection and obscure their commands.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Page 131 of 213