Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Specifically flags Invoke-WebRequest being launched directly from the Explorer shell context, bypassing normal script delivery to pull the Potemkin loader.
Detects the execution of known Remote Monitoring and Management (RMM) tools from common user-writable or temporary directories (Temp, Downloads, AppData, Public). The rule further filters for processes commonly abused for payload delivery and command execution (powershell.exe, cmd.exe, wscript.exe), or processes containing typical obfuscation and download indicators, excluding benign system process initiators.
Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.
Detects post-execution cleanup activities associated with Yuta/Glove stealer, including the deletion of files in PyInstaller temp directories (_MEI*), temporary paths, and the removal of specific stealer components (e.g., YutaCore.dll, SLaunch.exe) via command-line utilities like cmd.exe or PowerShell.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
This rule detects potential tunnel creation using PowerShell. It identifies network connections from PowerShell processes to common SSH (22) or Tor (9001, 9050) ports, as well as PowerShell script block activity involving socket connections directed at .onion domains, SSH keys, or authorized keys files, which may indicate remote access tunneling or command-and-control communication.
Detects instances where a Node.js process (invoked via npm) spawns suspicious secondary processes such as shell interpreters (cmd, powershell, sh, bash) or network utilities (curl, wget). This pattern is often indicative of malicious npm lifecycle scripts (e.g., preinstall, postinstall) attempting to perform system reconnaissance or download secondary payloads.
This rule detects various User Account Control (UAC) bypass techniques (such as fodhelper.exe or eventvwr.exe hijacking), registry modifications involving 'ms-settings' classes, and the use of 'Start-Process -Verb RunAs' to request administrative privileges. It also flags potentially elevated installations of OpenSSH or Tailscale, which are commonly targeted by attackers following privilege escalation.
This rule detects the creation of scheduled tasks using either schtasks.exe or PowerShell (Register-ScheduledTask) that exhibit high-risk indicators. These indicators include executing files from suspicious locations (AppData, Temp, or specific user-writable directories), the use of encoded PowerShell commands, or initiation by common remote access tools (sshd, ssh, or mstsc). This behavior is often associated with persistence mechanisms used by adversaries.
This rule identifies instances of PowerShell executing with an encoded command followed immediately (within 300 seconds) by an outbound network connection to a non-standard port or non-internal IP address. This behavior is indicative of a remote access tool or reverse shell establishing command and control (C2) communication.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Detects the execution of PowerShell with the EncodedCommand (-enc/-e/-ec) argument, which is frequently used by adversaries to hide malicious scripts and bypass simple command-line inspection. The rule excludes processes signed by Microsoft to reduce noise from legitimate system administration scripts.
Detects modifications to Windows Run or RunOnce registry keys by PowerShell or Reg.exe processes, specifically when originating from the WinGet DSC (Desired State Configuration) stack. The rule flags entries where the registry value points to potentially sensitive/user-writable directories or contains evidence of encoded command execution (e.g., PowerShell base64 encoding or common obfuscated syntax).
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.
Page 85 of 213