Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects suspicious, obfuscated PowerShell commands by analyzing the command line for long string literals with low character diversity and high frequency of a single character. It extracts strings enclosed in single quotes, double quotes, or backticks, and then calculates the ratio of distinct characters to total length and the ratio of the most frequent character's count to total length. If these ratios fall below and above certain thresholds, respectively, the command is flagged as suspicious.
Detects the spawning of command-line interpreters (`cmd.exe` or `powershell.exe`) from processes associated with Windows Server Update Services (WSUS), such as `w3wp.exe` (IIS worker process for WSUS) and `wsusservice.exe`. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2025-59287, where attackers gain remote code execution on the WSUS server.
This rule detects suspicious process activity originating from Windows Server Update Services (WSUS) processes (wsusservice.exe or w3wp.exe with 'wsuspool' in its command line) that then execute known Living Off The Land Binaries (LOLBINs) associated with ingress tool transfer (T1105) or common Windows execution binaries such as cmd.exe, powershell.exe, or certutil.exe. This behavior could indicate the exploitation of a Remote Code Execution vulnerability in WSUS, such as CVE-2025-59287.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe or w3wp.exe (WsusPool). This behavior is a key indicator of exploitation for critical remote code execution vulnerabilities such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Detects the execution of a malicious LNK file exploiting the ZDI-CAN-25373 vulnerability, a technique used by threat actors like UNC6384. The exploit involves padding the command line arguments with excessive whitespace to hide the malicious command from the user in the file's properties. This rule identifies command or powershell execution containing a large amount of whitespace characters, which is characteristic of this technique.
Detects when the Windows Server Update Services (WSUS) process (wsusservice.exe) or its associated IIS worker process (w3wp.exe with 'wsuspool' in its command line) spawns cmd.exe or powershell.exe. This activity is highly suspicious as WSUS services typically do not need to execute command-line interpreters, and could indicate an attempt to exploit a vulnerability or execute arbitrary commands on the system.
This query looks for indicators of CVE-2025-59287 exploitation, a critical WSUS deserialization flaw (CVSS 9.8) enabling unauthenticated remote code execution. Focuses on network, process, and file artifacts associated with exploitation.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detection based on: https://malwaretech.com/2025/10/exif-smuggling.html
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
Detects Airstalk malware, used by the CL-STA-1009 threat cluster. This rule identifies both PowerShell and .NET variants that misuse the AirWatch MDM API for C2 and data exfiltration.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
Detects Airstalk malware, which exists in both PowerShell and .NET variants. The rule identifies specific strings related to its C2 communication over the AirWatch MDM API, tasking, and other unique artifacts.
Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.
Detects token obfuscation techniques commonly used by Invoke-Obfuscation within PowerShell scripts. This rule is designed to identify highly obfuscated PowerShell code that attempts to evade detection by manipulating string formatting, environment variables, and character escaping. It can be used as a threat-hunting baseline to find suspicious scripts in an environment.
Detects specific command-line patterns used by the Turla APT group, as detailed in an ESET report from May 2020. The rule looks for `tracert` commands targeting `yahoo.com`, PowerShell obfuscated commands involving `FromBase64String`, and `net use` commands attempting to connect to `docs.live.net` with an `@aol.co.uk` credential.
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects attempts to disable PowerShell command history logging using 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'. This is a defense evasion technique used by attackers to hide their activities, as seen in the PhantomCaptcha campaign.
Page 158 of 213