Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects PowerShell or pwsh processes that download remote content and subsequently compile it in-memory using Add-Type, a fileless execution technique observed in the SMOKE#SCREEN campaign to load .NET loaders without writing an executable to disk.
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects a PowerShell-driven sequence where a file is downloaded, has its Mark-of-the-Web removed via Unlock-File, then is executed through msiexec /i on the same file path within a 10-minute window, mirroring the SMOKE#SCREEN ScreenConnect delivery chain.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects fileless PowerShell execution using an encoded command line consistent with CountLoader v4.5p, corroborated by hidden-window/execution-bypass flags and excluding known legitimate deployment-tool parent processes.
Detects the DOUBLECUP ClickFix Stage 1 execution chain where a cmd /c for/f loop searches for powershell.exe via the wildcard pattern 'where pow?r?hell.exe' and pipes through findstr "ZZ1984" to locate and extract the steganographic PNG payload marker before invoking PowerShell.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects the execution of cmd.exe, powershell.exe, or pwsh.exe launched directly from Windows Explorer (explorer.exe) where the command line contains obfuscated arguments, long encoded strings, or specific indicators associated with common click-based execution attacks.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Page 68 of 213