Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects a Python process invoking native_host.py (the Edgecution native messaging host component) spawning cmd.exe or powershell.exe with command-line flags consistent with UNC6692's Edgecution malware suite execution capability, including PowerShell launched with -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command or cmd.exe launched with /c chcp 65001.
This rule detects suspicious process execution where PowerShell (powershell.exe) spawns a Python interpreter (python.exe or pythonw.exe) located in an AppData\Roaming directory. It specifically flags instances where the command line of the invoked process includes both a reference to the AppData\Roaming directory and a Python script (.py) file, which is a common behavior for loaders like CastleLoader attempting to execute scripts from user-writable directories.
Detects CountLoader's taskType 5 command dispatch: a PowerShell script block that downloads content (Invoke-WebRequest/DownloadString) then pipes it to Invoke-Expression with a subsequent main() function call, consistent with fetched reconnaissance modules executed in memory.
This query detects PowerShell-based AES encryption activity followed by mass file rename/encryption indicators and ransom note creation within a correlated pre-defined timestamp.
Detects PowerShell processes launched with encoded command arguments (-enc/-EncodedCommand) alongside reflective .NET assembly loading or ScriptBlock usage from the same process lineage within a 5-minute window, indicative of CountLoader-style in-memory payload execution.
Detects the AutoIT payload injector multi-stage execution chain (wscript.exe -> powershell.exe -> cmd.exe -> powershell.exe -> autoit3.exe -> charmap.exe) used to deliver VIPKeylogger and MedusaHVNC, culminating in process injection into the legitimate charmap.exe utility.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects PowerShell invoking Get-CimInstance against Win32_Process to enumerate running processes (ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine), converting output to compressed JSON, when spawned by or related to python.exe or cmd.exe -- consistent with the Edgecution native host's process-enumeration command (command 6).
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects PowerShell or pwsh execution containing a custom regex-based JSON key/value parsing pattern (mimicking CountLoader's manual JSON parsing) in either the raw command line or a base64-decoded encoded command, while excluding legitimate ConvertFrom-Json usage.
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects the execution of AutoHotkey-based Edgecution malware stagers (set36418917.ahk/.exe) and their associated file-drop events in unusual locations like user temp and downloads folders. This activity is associated with the threat actor UNC6692 following hands-on-keyboard access via Quick Assist.
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
Page 70 of 213