Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
Detects the use of PowerShell to manually modify file system timestamps (CreationTime, LastWriteTime, LastAccessTime) on ASPX files or within common web-accessible directories. This technique is often used by adversaries to hide the true creation or modification time of webshells, facilitating anti-forensic activities and timeline corruption.
Detects suspicious child process creation originating from Adobe ColdFusion or IIS worker processes (w3wp.exe). This rule monitors for the execution of command-line shells, scripting engines, or download utilities often used in exploitation of vulnerabilities like CVE-2023-26360, CVE-2023-29298, or CVE-2023-29300.
Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.
Detects ClickFix attack patterns where users are coerced into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The command uses clipboard access (Get-Clipboard) or network download/execution (iwr, iex) methods, commonly associated with the Potemkin Loader or RMM-based distribution campaigns.
Detects suspicious activities originating from OpenVPN Connect processes, including the spawning of command-line interfaces, scripts, or proxies, as well as the creation of specific ACE marker files and modifications to browser proxy settings, which are indicative of potential exploitation or post-exploitation activity.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.
Detects ClickFix-style attacks where users are social-engineered into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The rule specifically monitors for powershell.exe being initiated by explorer.exe with command-line arguments involving clipboard access (Get-Clipboard) or web-based script retrieval/execution (iwr, iex).
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.
Detects instances where the Visual Studio Code process (code.exe) spawns shell or scripting interpreters (such as cmd.exe, powershell.exe, python.exe, etc.) to execute commands involving sensitive file paths, development configuration files, or suspicious keywords, specifically within a short duration (5 minutes) after Git or NPM activity has occurred on the same host. This pattern may indicate exploitation or unauthorized code execution triggered through a compromised or malicious development environment.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.
Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
Page 82 of 213