Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell commands initiated directly from explorer.exe that contain indicators of the 'ClickFix' attack vector, specifically commands designed to extract data from the clipboard (e.g., Get-Clipboard) or download/execute remote content (e.g., iwr, iex). This activity typically occurs when a user is socially engineered into copying and pasting malicious instructions into the Windows Run dialog.
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Detects the use of Windows Package Manager (winget) or Configuration Remoting Server processes to execute account management commands such as adding users or modifying group memberships via net.exe or PowerShell. This behavior is indicative of privilege escalation or persistence attempts using legitimate administrative tools.
Detects cmd.exe spawning powershell.exe with command-line arguments indicative of a reverse shell, specifically leveraging encoded commands or TCP socket objects. This pattern is characteristic of attackers injecting malicious keystrokes via the Remote Mouse Socket.IO service.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.
Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects instances where explorer.exe (acting as a parent process due to a user executing commands via the Win+R Run dialog) spawns common command-line interpreters or script hosts (powershell.exe, cmd.exe, mshta.exe, wscript.exe) with suspicious command-line arguments indicative of malicious activity, such as encoded commands, downloader patterns, or file execution proxies. This pattern is consistent with ClickFix-style social engineering attacks where users are tricked into copying and pasting malicious payloads from a webpage into the Run dialog.
Detects rapid execution of multiple network reconnaissance commands on a single host. Adversaries often use these built-in utilities (e.g., ipconfig, net, arp) to map an environment's network configuration, users, shares, and service structure after initial compromise to inform subsequent lateral movement.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Unrestricted) originating from the ScreenConnect SystemTemp directory. This behavior is consistent with malicious campaigns, such as those deploying AsyncRAT via trojanized installers, that utilize the ScreenConnect temporary storage path to stage and execute secondary malicious payloads.
This rule detects potential exploitation of vulnerabilities (such as CVE-2026-33017) where mshta.exe or wscript.exe spawns PowerShell, followed by the addition of a persistent entry to the HKCU Run registry key targeting Node.js or JavaScript files.
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
This rule detects potentially unauthorized or suspicious outbound network connections to common Generative AI service APIs (OpenAI, Anthropic, Mistral) originating from command-line interpreters (cmd.exe, powershell.exe) or python.exe instances running from temporary directories, which could indicate data exfiltration or the use of AI tools for malicious automation.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Page 79 of 213