Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects presence of a potentially xor encoded powershell command
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Page 141 of 213