Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where the WinRAR archive utility spawns a PowerShell process with command-line arguments typically associated with obfuscated or fileless execution. The detection specifically flags PowerShell commands that employ techniques such as base64 encoding, execution policy bypass, hidden window styles, or commands containing indicators of in-memory process manipulation such as NtAllocateVirtualMemory or memory allocation constants.
Detects the use of PowerShell to read files from the C:\ProgramData directory using the -Raw parameter, followed by the execution of the content via Invoke-Expression (iex). This pattern is often used to execute obfuscated payloads stored in non-standard locations while bypassing basic execution constraints.
Detects web browsers or file explorer spawning common script interpreters (PowerShell, CMD, mshta, etc.) with command-line arguments indicative of malicious activity, such as encoded commands, Base64 strings, or web-based script downloads, typical of ClickFix or similar browser-based social engineering attacks.
Detects the use of PowerShell .NET reflection to access non-public static fields within the System.Management.Automation.AmsiUtils class. Attackers often target fields such as 'amsiInitFailed' or 's_amsiContext' to programmatically disable or bypass Antimalware Scan Interface (AMSI) inspection during script execution.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects execution of PowerShell commands associated with the Pay2Key ransomware, specifically searching for command lines that reference bin-staged payloads (data1.bin, data2.bin, data3.bin) and a hardcoded XOR key (12199) used to deobfuscate the payloads in memory before execution via Invoke-Expression or similar methods.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects web server processes (e.g., PHP, IIS, Apache, Nginx) spawning suspicious child processes including shells (cmd.exe, powershell, bash) or network utilities (curl, wget, netcat), which is often indicative of webshell exploitation or post-compromise activity.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.
This rule detects a multi-stage activity chain where a user performs a git clone, followed by Visual Studio Code, Node, or Python spawning a shell or interpreter, which then initiates a network connection to known suspicious staging infrastructure. This behavior is indicative of a developer machine being compromised to exfiltrate code or download malicious payloads.
Detects the execution of command-line shells (powershell.exe or cmd.exe) spawned by processes that are typically associated with system services or security products (e.g., svchost.exe, MsEdgeUpdate.exe), where the parent process is not located in the standard Windows System32 directory. This pattern often indicates attempts to bypass security controls or masquerading by malicious actors to achieve code execution.
Page 84 of 213