Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects suspicious child processes, such as shells and system utilities, spawned by PaperCut application processes (pc-app.exe, pc-app-service.exe) or associated Java/Tomcat service components. This pattern is commonly observed during exploitation attempts targeting PaperCut Print Management software, where attackers use web services to gain command execution.
Detects execution of PowerShell or CMD initiated by the Kimsuky GitPower loader. The rule identifies suspicious command-line artifacts including excessive character padding (leading spaces), extremely long command lines, and the presence of a hardcoded, unique base64 decoding variable ('$VIUSBvejbawf') associated with this specific malware family.
Detects the execution of PowerShell with specific command-line arguments (-NonInteractive, -NoProfile, -Command) often used by the Bird Agent backdoor or similar malicious scripts to execute code silently without user intervention or profile configuration.
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
This rule detects instances where mshta.exe acts as a parent process to initiate powershell.exe. It specifically looks for command line arguments that employ obfuscation techniques, such as character casing variations (e.g., 'POWERsHeLl'), while simultaneously excluding standard casing, combined with flags typical of non-interactive execution (e.g., -NonInteractive or /w h /c). This pattern is commonly used by adversaries to bypass security controls and execute scripts hidden from user view.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
Detects the execution of PowerShell commands that utilize both obfuscation techniques (such as Base64 encoding or 'FromBase64String') and remote payload retrieval or memory execution methods (such as 'IEX', 'DownloadString', or 'Invoke-WebRequest'). This combination is a classic indicator of malicious PowerShell activity designed to download and execute second-stage payloads.
Detects anomalous child processes spawned by the Microsoft Exchange IIS worker process (w3wp.exe). This activity is often observed during post-exploitation phases of vulnerabilities like ProxyLogon (CVE-2021-26855), where attackers attempt to gain code execution by spawning command shells or administrative tools from the web server process.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule detects the execution of PowerShell from a WScript or CScript parent process where the PowerShell script also performs suspicious actions such as reading environment variables (specifically those following a 'Kv\d+' pattern) and accessing files using 'IO.File::ReadAllText'. This behavior is indicative of malicious scripts, such as those used by specific malware or post-exploitation tools, attempting to retrieve configuration data or credentials stored in environment variables.
Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.
Detects the execution of PowerShell with suspicious command-line arguments (obfuscation, hidden windows, or encoded commands) directly spawned from explorer.exe. This activity is frequently associated with malicious scripts or payloads executing in the context of user activities to evade detection.
Detects malicious PowerShell scripts that perform reflective loading of .NET DLLs into memory. The rule identifies patterns associated with the 'ClickFix' or 'StealC' loaders, specifically looking for combinations of Assembly.Load, GZip decompression, and hardcoded AES encryption keys/IVs frequently used by these campaigns.
Detects the execution of PowerShell with encoded commands that are unusually long (over 300 characters). Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, and long encoded strings are a strong indicator of non-interactive or automated command execution, such as during the initial stage of an attack.
Detects the use of PowerShell commands that perform decryption (AES-256-CBC) and decompression (Gzip) of data, followed by the reflective loading of a .NET assembly into memory using [Reflection.Assembly]::Load. This behavior is indicative of fileless malware execution where a payload is hidden in an obfuscated or compressed format and unpacked at runtime.
Detects instances of PowerShell being launched directly from Windows Explorer (explorer.exe) using suspicious command-line arguments. This pattern is commonly associated with malicious scripts, remote access trojans, or fileless execution techniques where an adversary executes code through shell-based file interaction.
Detects obfuscated PowerShell commands bypassing execution policy to download or execute 'configuration.ps1' or communicate with known malicious infrastructure associated with the ClickFix campaign. The rule specifically looks for caret-based obfuscation, bypass switches, and known IOCs in the command line.
Detects the execution of obfuscated PowerShell commands initiated from the Windows Run dialog (explorer.exe). This pattern is consistent with 'ClickFix' social engineering attacks where users are coerced into copying and pasting malicious, obfuscated code into the Run dialog. The rule monitors for common obfuscation artifacts such as carets, hidden window flags, encoded command arguments, and large base64-like blobs within the command line.
This rule detects PowerShell script execution patterns indicative of the StealC 'ClickFix' infection chain. It specifically looks for the reflective loading of an obfuscated .NET assembly from memory, involving common .NET cryptographic and compression classes such as AesCryptoServiceProvider, GzipStream, and assembly loading methods like Assembly.Load. The rule uses markers and script length heuristics to identify payloads characteristic of this malware delivery technique.
Detects PowerShell processes spawned from Windows Script Host (wscript.exe/cscript.exe) that interact with environment variables starting with 'Kv'. This behavior is indicative of the LausivLoader malware, which passes data between script stages via inherited environment variables to avoid using command-line arguments.
Page 42 of 213