Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of PowerShell commands that utilize hidden window styles and encoded payloads, specifically when the command line or image path references 'WindowsUpdate.log'. This pattern is often used by adversaries to hide malicious scripts and potentially interact with logs in an attempt to masquerade or tamper with Windows Update processes.
Detects the execution of PowerShell with suspicious command-line arguments (hidden window, no profile, or encoded commands) spawned directly from a web browser process (e.g., Chrome, Edge, Firefox, Explorer). This behavior is characteristic of ClickFix-style social engineering attacks where a user is tricked into copying and executing malicious PowerShell commands via the Win+R Run dialog or terminal.
Detects PowerShell execution containing multiple command-line arguments indicative of environment discovery, such as checking system uptime, hardware specifications, or specific memory-related delays. These patterns are commonly used by malware to detect virtual machines, sandboxes, or analysis environments to alter execution or exit.
Detects suspicious PowerShell activity involving compression commands (e.g., Expand-Archive) within APPDATA, correlated with the execution of hypersnap.exe with hidden window arguments, and the creation of persistence via scheduled tasks. This pattern is indicative of automated staging or malicious tool execution and persistence setup.
Detects the execution of PowerShell with hidden window arguments from explorer.exe, typically indicative of ClickFix social engineering where a user is tricked into pasting malicious commands into the Windows Run dialog.
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects instances where browser automation tools (e.g., Selenium, Puppeteer, Playwright) or headless browser instances initiate command-line interpreters or scripting hosts. This behavior is indicative of potential automated exploitation, such as browser-based attacks where a malicious script attempts to execute commands directly on the host operating system.
Detects instances where a GitLab Runner process (gitlab-runner-windows-amd64.exe) spawns PowerShell with flags commonly associated with bypassing execution policies and executing non-interactive commands. This behavior may indicate an attacker using a CI/CD runner as an entry point for lateral movement or command-and-control.
Detects instances where PowerShell is launched as a child process of WScript.exe or CScript.exe with suspicious command line flags intended to hide window visibility, bypass execution policies, or run in a non-interactive mode. This behavior is frequently used by adversaries to execute obfuscated or malicious scripts while minimizing user awareness.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects the execution of signed, Microsoft-publisher binaries that are located in typically user-writable or suspicious directories (e.g., AppData, ProgramData, Temp, Users) when initiated by cmd.exe or powershell.exe with an argument indicating a batch file reference. This pattern is indicative of potential masquerading or living-off-the-land techniques where a signed binary is moved or executed from an unconventional location to bypass security controls or execution policies.
Detects instances where cmd.exe spawns a powershell.exe process with the execution policy set to bypass. This is a common technique used by attackers to execute malicious scripts while bypassing local security restrictions on script execution.
Page 28 of 213