Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
This rule detects command-line executions that attempt to disable Windows Defender or the Windows Firewall. It specifically looks for process creation events (EventID 4688) where the command line contains keywords like 'disable' along with 'defender' or 'firewall', executed via PowerShell or cmd. This activity is indicative of an adversary attempting to impair defenses.
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) of a malicious script behind the Get-Alias or Get-Command cmdlet shortcuts (gal/gcm).
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
Detects the creation of local user accounts or adding users to privileged groups triggered by ConfigurationRemotingServer.exe. This activity is indicative of potential misuse of the WinGet DSC (Desired State Configuration) capability to maintain persistence or escalate privileges on a Windows host, a technique observed in the DSCourier malware.
This rule detects suspicious child process creation originating from 'setup.exe' (specifically with 'metakit' arguments) or 'IntelAudioService.exe' (specifically with sideloading-related arguments like '/appmodel', '/StateRepository', and '/Service'). These indicators are commonly associated with the SPECTRALVIPER threat activity, where legitimate-looking processes are abused to launch secondary, potentially malicious tools like cmd, powershell, or other system utilities.
This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects SMB traffic patterns containing commands indicative of file obfuscation or permission tampering, specifically the use of 'attrib' to set hidden or system attributes, 'icacls' to deny access to files, or PowerShell execution with the '-WindowStyle Hidden' argument.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Detects two distinct malicious PowerShell behaviors: memory-resident script execution using Base64 and XOR obfuscation, and unauthorized modification of Windows Defender preferences to add exclusions.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects instances where PowerShell is spawned by cmd.exe and includes command-line arguments indicative of a reverse shell, such as network socket creation, hidden execution, or encoded commands. This pattern often follows suspicious parent processes or activities such as keystroke injection.
This rule detects a sequence of events where a host initiates a network connection on port 1313 (a common port associated with certain web-based C2 or exploitation frameworks) followed shortly by an outbound network connection initiated by PowerShell within a 5-minute window. This behavior is indicative of a post-exploitation phase where an initial entry point leverages a malicious script or shell to establish persistent communication.
Page 83 of 213