Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects anomalous process execution (cmd.exe or powershell.exe) initiated by PaperCut application server processes (pc-app.exe or java.exe), followed immediately by the modification of the 'Domain Admins' group membership. This behavior is indicative of potential post-exploitation privilege escalation activity following a successful PaperCut authentication bypass.
Detects known persistence binaries or suspicious file paths associated with the CHOSEN BRICK threat actor executing common discovery commands such as tasklist, systeminfo, and process enumeration scripts. This pattern aligns with the post-compromise reconnaissance phase performed prior to further malicious activity.
Detects instances where common Windows web server processes (w3wp.exe or UMWorkerProcess.exe) initiate suspicious child processes (cmd.exe, powershell.exe, etc.) within a short duration of a file modification event involving known potentially malicious DLL files (winfsp-x64.dll or DukeQt.dll), characteristic of web shell exploitation or post-compromise activity on Exchange/IIS servers.
Detects the execution of a hidden PowerShell process that subsequently spawns a child process using the 'Start-Process' cmdlet with the '-Verb RunAs' argument within a short time window. This pattern is commonly associated with attempts to bypass User Account Control (UAC) or execute processes with elevated privileges silently.
This rule detects repeated PowerShell executions using 'Start-Process' with the 'RunAs' verb and hidden window styles. The detection specifically looks for high-frequency occurrences of these commands within a tight 18-25 second window on the same host, which is characteristic of certain automated execution or privilege escalation attempts.
Detects a multi-stage PowerShell execution pattern often associated with 'ClickFix' or similar social engineering lures, where a base64-encoded or obfuscated command is used to invoke malicious network downloads (IEX, WebClient, DownloadString). The rule further correlates these execution patterns with potential persistence mechanisms, specifically monitoring modifications to Windows startup locations or Run keys.
Detects a suspicious multi-stage PowerShell execution pattern where an initial process utilizing obfuscated arguments (e.g., -EncodedCommand) launches a secondary PowerShell process that performs network operations indicative of downloading and executing a remote payload.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.
Detects the execution of wmic.exe, powershell.exe, or pwsh.exe with command-line arguments related to querying antivirus products or security centers (e.g., AntiVirusProduct, SecurityCenter2). The rule focuses on executions originating from non-standard system paths (e.g., Temp, Users, AppData) or processes that lack a valid code signing signature, which is often indicative of reconnaissance by malicious actors.
Detects post-exploitation shell activity spawned from the IIS worker process (w3wp.exe), narrowed to command lines carrying encoded/obfuscated PowerShell flags, remote-download cradles, or basic recon/persistence commands (whoami, certutil, bitsadmin, schtasks, reg add). This reduces noise from benign w3wp.exe-initiated automation while retaining the behavioral pattern seen in the Telerik UI for ASP.NET AJAX unauthenticated RCE chain (webshell/in-memory DLL execution dropping to a shell).
Detects PowerShell command lines that attempt to hide the console window by calling ShowWindowAsync from user32.dll while assigning a randomly generated GUID as the window title. This technique is used to evade detection by keeping malicious PowerShell activity invisible to the user, as seen in recent StealC infostealer loader chains.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects the execution of known command-line utilities (cmd, powershell, mshta, wscript) spawned by explorer.exe that utilize external network request tools (curl, finger) to initiate network connections. This pattern is commonly observed in stage-1 downloader behavior where a user-initiated action from explorer triggers an attempt to pull down external payloads.
Detects instances where explorer.exe spawns cmd.exe or powershell.exe with command-line arguments indicative of obfuscated execution, such as encoded commands, hidden window styles, or bypass flags. This pattern is consistent with ClickFix social engineering attacks where users are deceived into manually executing malicious commands via the Windows Run dialog.
Detects instances where explorer.exe spawns cmd.exe or powershell.exe with command-line arguments indicative of obfuscated execution, such as encoded commands, hidden window styles, or bypass flags. This pattern is consistent with ClickFix social engineering attacks where users are deceived into manually executing malicious commands via the Windows Run dialog.
Detects the use of PowerShell to load .NET assemblies directly from memory or via Base64/encoded streams. This technique is commonly used by malicious payloads to execute shellcode, reflection-based attacks, or obfuscated scripts while minimizing their on-disk footprint.
Detects execution of PowerShell commands containing suspicious arguments (e.g., encoded commands, download cradles) initiated by scheduled task binaries (svchost.exe, taskeng.exe, schtasks.exe) or involving specific suspicious strings associated with identified threat activity.
Page 47 of 213