Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule detects the execution of common command-line interpreters (powershell.exe, cmd.exe, cscript.exe) or generic executables from suspicious user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. It specifically excludes 'msbuild.exe' and 'dotnet.exe' to reduce false positives. A high count (3 or more) of such events within an hour for a given computer and user is flagged as an anomaly, indicating potential malicious activity like malware execution or persistence.
Detects the execution of the Restart-Computer cmdlet with the -Force flag via PowerShell, a technique used by a recent malware dropper to disrupt sandbox analysis.
Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
This rule detects a high volume of PowerShell or Command Prompt executions from a single computer by a single account within a one-hour window. This behavior can be indicative of an APT-style multi-stage attack pattern where an adversary is executing numerous commands in quick succession, potentially for discovery, execution, or privilege escalation. The rule specifically looks for command lines containing 'powershell' and '-enc' (encoded command) or 'cmd' and '/c' (execute command and terminate).
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
This rule detects command-line executions that attempt to disable Windows Defender or the Windows Firewall. It specifically looks for process creation events (EventID 4688) where the command line contains keywords like 'disable' along with 'defender' or 'firewall', executed via PowerShell or cmd. This activity is indicative of an adversary attempting to impair defenses.
Detects PowerShell commands attempting to add Windows Defender exclusion paths for directories associated with the 10FXRAT malware. This rule specifically looks for the use of 'Add-MpPreference' with '-ExclusionPath' in the command line, combined with the presence of 'AppNetSvc' or 'WinDiagTrack', which are known directories used by 10FXRAT for staging and persistence.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects PowerShell commands attempting to disable Microsoft Defender real-time monitoring or adding broad path exclusions, indicating defensive tampering.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives). This technique is known to be used by the GammaSteel threat group to monitor and potentially steal data from physical media.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Page 135 of 213