Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by utilizing .NET reflection and IL generation. This technique involves creating dynamic methods and emitting instructions to manipulate the memory space of AmsiUtils, effectively disabling or blinding AMSI during script execution.
Detects a potential exploitation of CVE-2026-12957, where a malicious git repository contains an MCP (Model Context Protocol) configuration file. When this workspace is opened, the Amazon Q Developer extension for VS Code improperly processes this configuration, resulting in the unauthorized execution of shell processes (cmd.exe, powershell.exe, bash, or sh) by the extension's host processes (code.exe or node.exe).
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
Detects the execution of known malicious or hijacked npm and Go packages associated with the Lazarus Group 'Contagious Interview' supply chain campaign. The rule monitors for node.exe or go.exe spawning unexpected child processes like shells or download utilities (e.g., curl, powershell) and the presence of specific malicious package names in command lines.
Detects malicious activity associated with the Yuta/Glove Stealer malware family. The rule identifies attempts to register persistent WMI event subscriptions (using wmic, powershell, or pwsh) to trigger execution or the registration of low-level keyboard hooks (WH_KEYBOARD_LL) for keylogging, originating from suspicious process paths like winupdate.exe or PyInstaller-compiled temporary directories.
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
This rule detects multiple behavioral indicators associated with malware deployment, including PyInstaller environment artifacts, reconnaissance via system utilities (wmic, tasklist), and suspicious process hollowing/stager chains (e.g., mshta/wscript/cscript invoking PowerShell followed by payload execution from temporary directories). These behaviors are often associated with loaders like BQTLock and Remcos.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
Page 81 of 213