Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.
Detects instances of PowerShell launching with a hidden window style and subsequently executing the 'tar' command to extract files into the LocalAppData directory, a pattern observed in Mustang Panda loaders.
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Masqueraded wt.exe - Branch A: Impostor Binary Named wt.exe Detects a process with image name wt.exe whose OriginalFileName does NOT match wt.exe — i.e., a renamed binary masquerading as Windows Terminal.
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
Detects the creation of specific VBScript or PowerShell dropper files (6202033.vbs, 6202033.ps1) within temporary directories. This activity is indicative of malware attempting to establish a foothold or execute malicious code.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Just reading about a fake Boeing RFQ was enough to trigger a full attack chain — starting from a DOCX and moving through RTF, JavaScript, PowerShell and even a full Python runtime, ending with Cobalt Strike running in memory.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
A recent worldwide cyberattack campaign has been detected involving the npm package axios. Malicious versions were reportedly used to deploy a remote access trojan during installation, which may impact developer workstations and CI/CD environments.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Page 144 of 213