Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects SyncAppvPublishingServer used for PowerShell proxy execution
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects attempts to access or exfiltrate DPAPI (Data Protection API) credentials stored in the 'CREDHIST' folder. Specifically, it looks for file events within the `\Microsoft\Protect\CREDHIST` folder where the initiating process is either `dpapisnoop.exe` or `powershell.exe`. `dpapisnoop.exe` is a known tool for DPAPI credential extraction, and PowerShell can also be used for similar purposes.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) spawns unexpected command shells or script interpreters. This is a strong indicator of post-exploitation activity following CVE-2026-41089 exploitation.
Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.
Detects privilege escalation attempts utilizing PowerShell's Start-Process cmdlet with the 'RunAs' verb. This technique can be used by malware like Lucid Stealer's UAC module to elevate privileges.
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects the Intune Management Extension agent spawning command interpreters. Because Intune executes scripts as SYSTEM, monitoring the resulting behavior on the endpoint is critical for identifying malicious script deployments.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Detects the execution of the LegionRelay client script, a PowerShell RAT utilized by the Russia-nexus threat group GREYVIBE. LegionRelay communicates with its command-and-control server via REST API methods and relies on operator-staged scripts for post-compromise activity. The detection matches on specific REST API paths and PowerShell artifacts found within the script block.
Page 134 of 213