Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of Windows command shell (cmd.exe or powershell.exe) to delete specific files often associated with malicious staging, temporary artifacts, or software components like drivers and configuration files. It specifically flags recursive or forced deletion commands targeting directories such as Temp, ProgramData, or specific filenames commonly used by malware.
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
Detects instances where wscript.exe or cscript.exe spawn a hidden PowerShell process that includes '-decode' arguments targeting files within the C:\ProgramData directory. This pattern is characteristic of the Kimsuky threat group, specifically the NUKESPED JSE loader, which uses Windows Script Host to execute staged, base64-encoded payloads.
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Detects the execution of PowerShell or PWSH where the command line contains common environment variables and paths associated with the Windows Startup folder. This pattern is commonly used by adversaries to achieve persistence, ensuring malicious scripts execute upon user login.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
Detects the execution of PowerShell commands that exhibit characteristics of reverse shells, such as the use of Nishang or Invoke-PowerShellTcp scripts, or the combination of web-download commands with expression evaluation. The rule also calculates a risk score based on the presence of common AMSI bypass flags (e.g., hidden windows, execution policy overrides) and specific reverse shell indicators.
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects AI coding agents (such as Claude Code, Cursor, Copilot CLI, etc.) spawning shell interpreters (bash, cmd, powershell) to execute installation or configuration scripts from within git-cloned repository directories. This activity is indicative of indirect prompt injection attacks where an adversary manipulates the agent into autonomously running malicious setup code.
Detects instances of PowerShell executing Base64-encoded commands initiated by Windows Explorer, a common technique used in the Potemkin Loader/ClickFix campaign to evade static analysis and security controls.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects PowerShell execution initiated by explorer.exe that explicitly uses the '-WindowStyle Hidden' parameter, a technique observed with the Potemkin loader to mask its execution.
Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.
Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.
Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Page 86 of 213