Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query from file: FileFix Detection
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query from file: Suspicious CLI Obfuscation
KQL Query
KQL Query from file: ClickFix social engineering attack detection
Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.
KQL Query
KQL Query
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
KQL Query from file: Unmanaged PowerShell Detection
KQL Query
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query from file: Cookie-Bite Detection
KQL Query
KQL Query from file: PowerShell Self-Pwn
Page 169 of 213