Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
Detects post-exploitation shell activity spawned from the IIS worker process (w3wp.exe), narrowed to command lines carrying encoded/obfuscated PowerShell flags, remote-download cradles, or basic recon/persistence commands (whoami, certutil, bitsadmin, schtasks, reg add). This reduces noise from benign w3wp.exe-initiated automation while retaining the behavioral pattern seen in the Telerik UI for ASP.NET AJAX unauthenticated RCE chain (webshell/in-memory DLL execution dropping to a shell).
Detects instances where PowerShell.exe is launched directly from the Windows Run dialog (explorer.exe as parent) with command-line arguments indicative of a ClickFix/ClearFake social engineering attack. This typically involves the user pasting malicious code, which often includes references to WebDAV UNC paths or external domains used for malicious delivery, into the Run dialog.
Detects the execution of PowerShell commands that attempt to retrieve hardware and OS-level system information using WMI queries or API-like indicators commonly used by reconnaissance tools.
Detects the loading of the hostfxr.dll module, the presence of the DLLMemLoader string in command lines, or the execution of python or pythonw processes. These patterns are often associated with the loading of malicious assemblies or execution via scripting environments.
Detects the loading of the System.Management.Automation.dll (PowerShell assembly) by processes other than standard PowerShell executable files. This behavior often indicates an attempt to execute PowerShell code from a non-standard process, potentially to bypass security controls or obfuscate malicious activity.
Detects the execution of network utilities like finger.exe or curl.exe (with download parameters) initiated by a command shell (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used by adversaries for reconnaissance or downloading malicious payloads.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden window, download strings, or invocation commands) initiated by Windows Explorer. This is a common pattern for malicious scripts or droppers attempting to execute code covertly.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
This rule detects potentially malicious child processes spawned by Visual Studio Code (Code.exe) when using VS Code tasks (tasks.json). It identifies suspicious CLI arguments often associated with downloading, executing, or obfuscating scripts (e.g., PowerShell, curl, python, mshta) that are not part of standard development workflows like npm, yarn, or git, which are explicitly filtered out as noise.
This rule detects potentially malicious child processes spawned by Visual Studio Code (Code.exe) when using VS Code tasks (tasks.json). It identifies suspicious CLI arguments often associated with downloading, executing, or obfuscating scripts (e.g., PowerShell, curl, python, mshta) that are not part of standard development workflows like npm, yarn, or git, which are explicitly filtered out as noise.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., -enc, -nop, -windowstyle hidden) originating from an LNK file launched by explorer.exe. This pattern is commonly used by adversaries to execute obfuscated malicious payloads embedded within shortcut files.
This rule detects PowerShell commands that utilize specific character array joining techniques (e.g., [char]nnnn -join '') often used to obfuscate malicious strings or bypass keyword-based security filters. This is a common tactic for evading detection when downloading or executing payloads.
This rule monitors the Microsoft IIS worker process (w3wp.exe) for the spawning of suspicious child processes often associated with web shell activity, such as command shells (cmd.exe, powershell.exe) or compiler/utility tools (csc.exe, cvtres.exe, rundll32.exe, regsvr32.exe). It further filters for command lines containing Exchange or OWA-related strings, and flags executions containing known web shell indicators (e.g., VIEWSTATE, GhostWebShell, reGeorg).
This rule monitors command-line activity for common scripting interpreters (Python, PowerShell, Bash, CMD) and flags processes that contain suspicious commentary. It looks for excessive use of comments (3 or more) or specific narrative phrases often found in malicious scripts, such as references to encrypting, dropping, deleting, or escalating privileges, which are indicative of obfuscated or malicious intent.
Detects the execution of powershell.exe or cmd.exe with a combination of -NonInteractive, -NoProfile, and -Command arguments. This combination is frequently used by adversaries to execute scripts or commands stealthily, without user interaction or loading profile configuration files, which is a common behavior during the execution phase of an attack.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of common command-line utilities or scripting interpreters, such as cmd.exe, powershell.exe, or certutil.exe. This behavior is highly atypical for web servers and is often indicative of exploitation attempts or post-exploitation activities following an initial compromise of a web application.
This rule detects potential web shell activity on Microsoft Exchange servers by identifying suspicious processes (like cmd.exe, powershell.exe) spawned by w3wp.exe (IIS worker process) that are associated with the creation or modification of common web shell file extensions (.aspx, .ashx, .asax) within critical Exchange server directories.
This rule monitors for execution patterns associated with the Evil-WinRM tool, a common post-exploitation framework used for remote command execution via WinRM. It identifies suspicious command-line arguments in PowerShell, the creation of configuration files typical of the tool, and network connections to WinRM ports initiated by common execution binaries like PowerShell or Ruby.
Page 41 of 213