Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.
Detects PowerShell launched with ExecutionPolicy Unrestricted and stdin command execution (-Command -), matching behavior described in fake Windows 11 installer campaign.
The rule detects the execution of PowerShell where the command line includes invoke-CimMethod. This specifically highlights the programmatic invocation of CIM methods, alerting analysts to potential WMI-based attacks or unauthorized administrative actions being performed via script.
This rule detects PowerShell being used to add Windows Defender exclusions for file paths and processes associated with the ValleyRAT malware campaign. Specifically, it looks for `Add-MpPreference` command-line arguments that include `-ExclusionPath` with "trvePath" or `-ExclusionProcess` with "WavesSvc64.exe".
Detects PowerShell commands that attempt to load a .NET assembly directly into memory using reflection. This is common in fileless malware delivery, such as the Remcos RAT campaign described in the provided intel, which uses reflection to load the final RAT stage from a steganographic JPEG, making disk-based detection ineffective.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicating the use of Base64 encoded commands. Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by signature-based methods and to evade basic command-line logging. This detection specifically looks for the '-EncodedCommand', '-enc', or '-ec' flags (and their variations in casing) which are used to execute Base64 encoded strings as PowerShell commands.
Detects the execution of a PowerShell one-liner with obfuscation techniques characteristic of the MIMICRAT ClickFix campaign. This campaign tricks users into pasting a command that uses string manipulation and arithmetic to reconstruct and execute a malicious payload.
Detects PowerShell script content consistent with ETW disable (EventProvider.m_enabled) and AMSI bypass (AmsiUtils.amsiInitFailed) described in the MIMICRAT ClickFix chain.
Detects when the BeyondTrust remote support client process ('bomgar-scc.exe' or 'bomgar-scc') spawns a shell or a common reconnaissance/downloader tool. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2026-1731, where an attacker gains code execution and begins to explore the compromised system.
Detects suspicious command lines executed via the Windows Run dialog that combine DNS lookup commands commonly seen in ClickFix-style staging activity.
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
An expansion of https://detections.ai/rules/019c774e-8cbc-70b0-91d6-3d2fb93c5a00
Detects PowerShell execution with Unrestricted execution policy combined with suspicious flags or uncommon script extensions.
Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.
This detection identifies suspicious command-line obfuscation executed by common scripting engines such as PowerShell, CMD, and Windows Script Host. It detects high signal behaviors including string concatenation, repeated string reconstruction, character based assembly, and encoded command execution flags.
These techniques are commonly used to conceal execution intent and evade security monitoring. Alerts should be reviewed in context to distinguish legitimate scripting from potentially evasive activity.
These techniques are commonly used to conceal execution intent and evade security monitoring. Alerts should be reviewed in context to distinguish legitimate scripting from potentially evasive activity.
Detects the execution of common Living Off The Land Binaries and Scripts (LOLBAS) initiated from Windows Explorer. The detection logic specifically looks for command lines that contain indicators of obfuscation or padding, which are common techniques used in malicious LNK (shortcut) files to hide their true purpose. This rule identifies processes like mshta.exe, powershell.exe, cmd.exe, certutil.exe, cscript.exe, and wscript.exe being launched by explorer.exe with suspicious command-line arguments.
This rule detects suspicious DNS queries made by common Windows command-line interpreters and scripting engines. It specifically looks for `nslookup.exe` or `dig.exe` being spawned by `cmd.exe`, `powershell.exe`, `pwsh.exe`, `explorer.exe`, `wscript.exe`, `cscript.exe`, or `mshta.exe`. The detection is further refined by looking for specific DNS query types (TXT, MX, SRV, AAAA), service records (`._tcp.`, `._udp.`), or `.onion` domains in the command line. Additionally, it requires corroboration through the presence of an IP address or `-server=` in the command line, or specific PowerShell/command-line obfuscation/execution techniques, or suspicious top-level domains (TLDs) like `.xyz`, `.top`, `.tk`, `.ru`, `.cn`, `.cc`, `.ws`, `.pw`, `.onion`, `.direct`, `.surf`. The rule explicitly excludes queries to `localhost` or common legitimate DNS records like `_dmarc.`, `_dkim.`, `_spf.`, `_acme-challenge.`, `_domainkey.`, `_msdcs.` to reduce false positives.
Detects PowerShell one-liners using Invoke-RestMethod (irm) or Invoke-WebRequest (iwr) piped to Invoke-Expression (iex) to download and execute the TrustConnect or DocConnect RAT.
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Page 150 of 213