Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the use of the 'Add-MpPreference' PowerShell cmdlet with the '-ExclusionPath' argument to add specific file or directory paths to Microsoft Defender's exclusion list. This behavior is a common technique used by adversaries to bypass security controls by ensuring malicious tools or scripts are not scanned by Windows Defender. The rule specifically alerts on exclusions related to common staging areas or specific tools such as Telegram Desktop, SSH cache folders, and package management directories.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
Detects instances where Windows Terminal (WindowsTerminal.exe) is launched by Explorer and immediately spawns a shell process (PowerShell, PWSH, or CMD), specifically excluding devices that have recorded recent RunMRU registry history. This pattern may indicate suspicious or non-interactive execution by an adversary attempting to bypass traditional shell history tracking.
This rule monitors for PowerShell commands that combine common data collection flags ('-Recurse', 'Documents') with 'Invoke-WebRequest' to perform a POST method upload. This pattern is commonly associated with the staging and exfiltration of sensitive files from local directories to a remote destination via HTTP/S.
This rule detects the execution of suspicious shortcut (.lnk) files or the use of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) to initiate processes related to specific, potentially malicious filenames often associated with phishing or social engineering campaigns. The rule monitors for these activities occurring in user-writable directories such as Downloads, Desktop, or Temp.
This rule detects potentially malicious command execution initiated by or linked to the Bandizip archive utility. It identifies scenarios where Bandizip launches shells (cmd, powershell, wscript, cscript) to execute scripts or commands (e.g., .lnk files, .bat, .vbs, .js, .ps1), or where suspicious 'cmd.exe /k' commands are executed directly or through an updater process.
Detects the execution of PowerShell with specific Pester build script arguments, initiated by Windows Explorer, followed within 5 minutes by the execution of 'index.exe' on the same host. This sequence may indicate malicious activity involving script execution leading to the spawning of an unknown or suspicious 'index.exe' binary.
Detects the use of PowerShell to download the 'gitlab-runner-windows-amd64.exe' binary, potentially indicating unauthorized installation or deployment of automation agents using legitimate download sources.
This rule detects potentially malicious activity related to the installation or misconfiguration of GitLab runner executables. It looks for unusual service creation, direct execution of runner binaries from temporary locations (e.g., C:\Windows\Temp), and the presence of configuration files or PowerShell scripts in unexpected directories that might indicate persistent access or unauthorized setup of a build runner.
This rule detects instances where common system utilities like notepad.exe or calc.exe are spawned as child processes by PowerShell.exe, specifically when the initiating PowerShell process was spawned by gitlab-runner.exe but the parent process information no longer resolves correctly. This is often indicative of persistence or post-exploitation activities occurring after a CI/CD job has ostensibly finished.
Detects the sequential execution of multiple Microsoft-signed LOLBins (Living Off the Land Binaries) spawned by the same parent process (PowerShell or CMD) within a 5-minute window. This behavior is indicative of a cascading fallback mechanism used by post-exploitation tools to bypass application allowlisting or security controls.
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
This rule detects potential persistence mechanisms and suspicious execution patterns associated with the ChainScript malware. It specifically monitors for the creation of scheduled tasks using PowerShell with indicators like 'StreamServiceSharedBridge.ps1' or 'ComponentTask33Agent', and the execution of VBScript-based agents via wscript.exe. It also flags tasks configured with specific execution time limits often associated with this malware's behavior.
This rule detects potential persistence mechanisms and suspicious execution patterns associated with the ChainScript malware. It specifically monitors for the creation of scheduled tasks using PowerShell with indicators like 'StreamServiceSharedBridge.ps1' or 'ComponentTask33Agent', and the execution of VBScript-based agents via wscript.exe. It also flags tasks configured with specific execution time limits often associated with this malware's behavior.
Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.
Detects instances where processes other than legitimate PowerShell binaries load the .NET Common Language Runtime (clr.dll) or the System.Management.Automation assembly. This behavior is often indicative of 'PowerShell-less' execution techniques, where adversaries interact with the PowerShell engine directly from arbitrary host processes to execute malicious code or scripts.
Detects the execution of base64 encoded PowerShell commands initiated by conhost.exe with the --headless flag. The decoded command contains specific suspicious patterns, including accessing environment variables, reading file content, and deleting files, which is characteristic of malicious scripts attempting to stealthily interact with the environment.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Page 40 of 213