Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
In this attack, malware uses a renamed copy of PowerShell to read a hidden file and run it. The file contains more malware that gets executed in memory. What makes this suspicious is that the activity is started by a batch or command script, not by the user directly. A normal user would run programs by double-clicking or from a menu. Here, one script launches another, which then reads and runs hidden content. This is a common pattern in multi-stage attacks where each step hides the next. Security teams should look for this chain: a batch or command window starts a process that reads a specific file and executes what it finds. This rule helps catch that behaviour before the full malware takes over.
The rule detects instances where command interpreters such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, or cscript.exe launch fodhelper.exe. This specific parent-child process relationship is indicative of a potential User Account Control (UAC) bypass attempt. While legitimate administrative scripts might occasionally involve fodhelper.exe, this pattern is considered suspicious and warrants investigation due to its common use in privilege escalation techniques.
Detects PowerShell or Batch scripts attempting to download files from known malicious C2 domains (darkgptprivate.com, getintwopc.site). This activity is a fallback mechanism associated with the 'OpenClaw Agent' malware campaign
Detects the use of the 'Add-Type' cmdlet in PowerShell to compile and load C# code directly into memory. This technique is used by the TAMECAT backdoor to pivot from PowerShell to C# modules for tasks like exfiltration and browser data theft, bypassing file-on-disk scanning.
Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects the Notepad++ updater (gup.exe) spawning suspicious child processes such as shells or network tools. Legitimate updates should only spawn explorer.exe or the Notepad++ installer itself. This behavior has been observed in targeted attacks where the update process is hijacked to deliver malware and facilitate hands-on-keyboard activity.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, such as CVE-2026-21509, where an embedded OLE object leads to code execution.
Detects a potentially suspicious powershell script executions from temporary folder
Detects PowerShell retrieving, decoding, and executing a payload stored inside the Windows registry.
Detects the anomalous execution of Node.js from non-standard, user-writable directories or when spawned by a shell process. This behavior is indicative of the Tsundere Bot backdoor, often used by TA584. The rule specifically looks for node.exe running from common user-writable or temporary directories (AppData\Local, Users\Public, Temp) or when initiated by command-line shells like powershell.exe or cmd.exe.
Detects PowerShell scripts attempting to perform image steganography by loading System.Drawing assemblies and calling functions like GetPixel or LockBits to extract data. This technique was observed in an Amatera Stealer campaign where payloads were hidden in PNG files hosted on public CDNs.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a suspicious child process (like cmd.exe or powershell.exe) from a document located in a configured Office Trusted Location. While trusted locations are meant to bypass macro security warnings, the subsequent spawning of shell processes is a strong indicator of malicious macro execution for post-exploitation activities.
Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.
Detects PowerShell processes spawned by Visual Studio Code or Cursor IDEs that use suspicious flags like '-WindowStyle Hidden' and commands typical of download cradles. This behavior is associated with malicious extensions that execute second-stage payloads.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, Publisher, Visio, Access) spawns a suspicious child process. The child processes include commonly abused Windows utilities such as PowerShell, cmd, wscript, cscript, mshta, rundll32, certutil, bitsadmin, and regsvr32. This behavior can indicate malicious code execution originating from an Office document, often associated with phishing or document-based malware.
Detects the execution of a hidden PowerShell window that uses Invoke-WebRequest to download and then execute a second-stage PowerShell script. This behavior is characteristic of the IClickFix framework's "ClickFix" social engineering tactic used to deliver malware like NetSupport RAT.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects the execution of the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs' by a script host like wscript.exe or cscript.exe. This technique is used as a LOLBIN to proxy execution of other code, such as PowerShell, bypassing detections that focus on direct PowerShell execution or common parent-child process relationships. This was observed in a campaign delivering Amatera Stealer.
Detects PowerShell commands that use aliases and wildcard matching to dynamically resolve sensitive cmdlets like Invoke-Expression or Invoke-RestMethod. This technique is used to evade static analysis and keyword-based detections and was observed in the Amatera Stealer infection chain.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Page 153 of 213