Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.
This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.
Detects instances where cmd.exe spawns powershell.exe with command-line arguments indicative of malicious activity, such as network connection attempts via TCPClient or the use of Base64 encoded commands.
This rule detects a suspicious network connection on local port 1313 followed within 5 minutes by a PowerShell network connection to a non-standard port (not 80, 443, 8080, 8443). This behavior is characteristic of an initial exploit attempt targeting a service on port 1313, followed by a post-exploitation reverse shell.
Detects the execution of PowerShell with flags indicating encoded commands (-enc) or hidden window styles (-windowstyle hidden), which are common techniques used to obfuscate malicious activity or run payloads stealthily. This behavior is often associated with the post-compromise execution phase of various threats, including payloads delivered via malicious portals.
This rule detects instances where the Microsoft Defender process (MsMpEng.exe) spawns common command-line or scripting interpreters such as cmd, powershell, or wscript with System integrity. This behavior is highly irregular for a security product and may indicate process injection, defensive evasion, or malicious activity masquerading as a legitimate system process.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
This rule detects scenarios where Microsoft Office applications (Word, Excel, Outlook, PowerPoint, OneNote) spawn known suspicious child processes (LOLBAS) that exhibit command-line flags indicative of remote content retrieval or script execution (e.g., download strings, encoded commands) and subsequently initiate network connections to public IP addresses or URLs within a 15-minute window.
Detects persistence mechanisms associated with the UAC-0226 threat actor by identifying a LNK shortcut file located in the user Startup folder that executes a minimized cmd.exe process. This command shell subsequently launches a hidden PowerShell command that reads and executes code from C:\ProgramData\WC3 using Invoke-Expression (IEX). This activity is linked to the GIFTEDCROOK delivery chain.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects instances where FortiTray.exe or scheduler.exe (associated with FortiClient) initiate a cmd.exe process that subsequently launches a PowerShell process with hidden window (-w 1) and encoded command (-enc) flags. This pattern is indicative of a living-off-the-land attack where a legitimate, signed application process is abused to execute obfuscated malicious payloads.
Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.
Detects anomalous behavior associated with the 'tcc.exe' executable, which is often leveraged by the BeepRAT loader for malicious operations. The rule monitors for suspicious process start flags ('-nostdlib', '-run'), execution from unconventional locations (outside of standard Program Files), the spawning of common shell processes (cmd.exe, powershell.exe, etc.), and unsolicited outbound network connectivity. This rule effectively flags potential loaders or backdoor activity originating from this binary.
Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.
Detects the creation or registration of virtual machines across multiple hypervisor platforms (Hyper-V, VMware ESXi, and VirtualBox) using PowerShell, command-line utilities, or security event logs. The rule alerts on these actions when performed outside of designated business hours or by accounts not included in a pre-defined list of authorized administrators.
Detects the execution of command-line utilities (cmd.exe, powershell.exe, wscript.exe, curl.exe) when launched directly from a web browser or associated web-related processes (e.g., chrome.exe, msedge.exe). This pattern is often indicative of drive-by downloads or malicious web content attempting to execute code on the endpoint.
Detects evidence of arbitrary command execution originating from OpenVPN Connect, potentially via an echoed script payload that executes commands upon disconnect, bypassing security controls. The rule identifies suspicious child processes spawned by OpenVPNConnect.exe and detects the creation of a known proof-of-concept marker file.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Page 78 of 213