Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
The following analytic identifies child processes spawned by vmtoolsd.exe, the VMWare Tools service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as CVE-2023-20867. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.
Detects PowerShell commands that use Get-WmiObject to query Win32_Process, specifically looking for process names. This can be indicative of discovery or reconnaissance activities using WMI.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
Detects the usage of PowerDodder, a post-exploitation persistence tool that appends malicious commands to existing script files by hijacking their execution flow.
This rule detects a potentially malicious Human Interface Device (HID) attack where a newly connected keyboard device (e.g., a USB Rubber Ducky) immediately triggers the execution of a script interpreter such as PowerShell, CMD, or MSHTA. The correlation occurs within 60 seconds of device insertion, which is characteristic of HID-based keystroke injection attacks.
Detects the execution of a shell process (like cmd.exe or powershell.exe) spawned by the Microsoft HTML Application Host (mshta.exe). This behavior is often associated with malicious HTA files that use scripting objects like "WScript.Shell" to execute arbitrary commands, as seen in campaigns distributing Epsilon Red ransomware.
This detection identifies suspicious command-line activity (e.g. powershell, cmd.exe, wsl.exe, etc.) that is initiated via explorer.exe, suggesting potential user-initiated execution (e.g., copy-paste into Run dialog or file association abuse). This technique is commonly used in social engineering campaigns or malware execution patterns, and is associated with the campaign tag: fileFix.
Detects instances where PowerShell is used to download content from external domains using common web request methods (Invoke-WebRequest, iwr, wget, DownloadFile, DownloadString). This behavior is frequently observed during the initial stages of malware delivery, including payload staging or C2 beaconing. The rule excludes known benign sources like slackb.com/error and chocolatey and filters out system-level accounts to reduce false positives.
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
This rule detects suspicious PowerShell command patterns associated with the Chaos ransomware group. These commands are used for environment setup, preparing for large file downloads, and remote command execution.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
The following analytic identifies suspicious Cmdlet usage in Exchange Management logs, focusing on commands like New-MailboxExportRequest and New-ManagementRoleAssignment. It leverages EventCode 1 and specific Message patterns to detect potential ProxyShell and ProxyNotShell abuse. This activity is significant as it may indicate unauthorized access or manipulation of mailboxes and roles, which are critical for maintaining email security. If confirmed malicious, attackers could export mailbox data, assign new roles, or search mailboxes, leading to data breaches and privilege escalation.
The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.
Detects potential email harvesting using PowerShell cmdlets with export parameters, stealth flags, and uncommon parent processes.
CVE-2025-53770 is a critical zero-day vulnerability in on-premise Microsoft SharePoint Server, actively exploited in the wild, allowing unauthenticated remote code execution (RCE) with a CVSS score of 9.8. This means attackers can execute arbitrary code on a vulnerable server without needing login credentials.
Detects indicators and behaviors related to the Chaos ransomware group including command-line patterns, suspicious registry changes, and specific known IOCs.
The following analytic detects the execution of the `Get-ADUser` PowerShell cmdlet with parameters indicating a search for domain accounts with Kerberos Pre-Authentication disabled. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific activity. This behavior is significant because discovering accounts with Kerberos Pre-Authentication disabled can allow adversaries to perform offline password cracking. If confirmed malicious, this activity could lead to unauthorized access to user accounts, potentially compromising sensitive information and escalating privileges within the network.
Page 166 of 213