Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the execution of common command-line interface tools (such as PowerShell, cmd, wscript, and certutil) spawned by the SimpleHelp remote support binary ('simplehelp.exe'). It also monitors for specific network connections associated with the SimpleHelp infrastructure (IP 96.126.130.126 on port 58942) that may indicate remote support activity or misuse of the platform.
This rule detects potentially malicious activity where 'npm' or 'node' processes spawn sensitive child processes (e.g., cmd.exe, powershell.exe, python.exe, curl.exe) in contexts associated with package installation (e.g., node_modules, postinstall scripts) or known indicators of compromise related to supply chain attacks and credential theft.
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Detects the execution of PowerShell via explorer.exe containing a long Base64-encoded command string, which is characteristic of the Potemkin Loader used in ClickFix-style attacks to evade detection.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects when the IIS worker process (w3wp.exe) spawns common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This behavior is often a strong indicator of webshell activity or exploitation of web applications such as Microsoft Exchange or SharePoint.
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Detects Log4Shell JNDI exploitation attempts by scanning incoming network request data for JNDI patterns and simultaneously monitors for suspicious shell child processes (cmd, powershell, bash, sh) spawned by java.exe, indicating post-exploitation activity.
This rule detects potential discovery activities indicative of a virtual machine or virtualization environment enumeration. It monitors for the execution of wmic.exe or powershell.exe triggered by suspicious parent processes (python.exe, chost.exe) that query hardware-specific identifiers like Manufacturer, Model, or MAC Address using Win32_ComputerSystem or Win32_NetworkAdapterConfiguration.
This rule detects potentially malicious activity associated with Java applications or the Lunar Client, specifically targeting the creation of shortcut files (.lnk, .command, .desktop) by Java processes, and the unexpected spawning of shells or interpreters by 'javaw.exe' or Lunar Client processes. These patterns are consistent with modpack-based Remote Code Execution (RCE) attempts or abuse of Electron IPC mechanisms.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects indicators of compromise associated with CVE-2026-45115 in OpenVPN Connect, including suspicious child processes spawned by OpenVPN, the creation of known PoC marker files, and the execution of commands containing exploitation strings related to echo script injection.
Page 88 of 213