Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
This rule detects the LabubaRAT malware utilizing the 'nvidia-sysruntime.exe' process to spawn 'cmd.exe' or 'powershell.exe' for command-and-control tasking. It monitors process creation events to identify suspicious parent-child relationships where the NVIDIA system runtime binary is used to invoke command shells with specific command-line arguments, typical of RAT shell tasking behaviors.
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects the execution of PowerShell (powershell.exe) spawned by the Windows Command Shell (cmd.exe) where the command originated from user-writable directories such as Downloads, Temp, or AppData\Local\Temp. This pattern is commonly associated with the execution of downloaded payloads or malicious scripts.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Page 74 of 213