Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects Microsoft SQL Server (sqlservr.exe or mssql.exe) spawning common administrative or potentially malicious utilities (e.g., cmd.exe, powershell.exe, curl.exe, etc.). This behavior is often indicative of unauthorized code execution or lateral movement originating from the database engine, which should not typically initiate these processes.
Detects the SQL Server process (sqlservr.exe) spawning suspicious child processes often associated with reconnaissance or command execution, such as command shell, PowerShell, or network diagnostic utilities. This is a common technique used by adversaries to execute commands or perform post-exploitation activities via database services.
Detects the Windows Package Manager (winget.exe) spawning the ConfigurationRemotingServer.exe process. This behavior, observed when using the 'winget configure' command, may indicate the execution of embedded PowerShell DSC scripts that can be used to maliciously configure a machine.
Detects instances where the Microsoft SQL Server process (sqlservr.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative tools. This behavior is often indicative of remote code execution exploitation or post-exploitation activities following initial access on a database server.
Detects instances where the Windows Subsystem for Linux (WSL) process spawns a Windows command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is often used to execute native Windows commands from within a Linux environment, potentially as a technique for stealthy command execution or to bypass traditional Windows-based monitoring and security controls.
Detects the execution of PowerShell via WScript or CScript (ActiveX Scripting hosts) where the PowerShell command line includes suspicious arguments typically used for obfuscation, bypassing security policies, or launching payloads from the ProgramData directory.
Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.
This rule detects potentially suspicious process activity where unknown or infrequently seen processes spawn common script interpreters such as cmd.exe, powershell.exe, wscript.exe, or others. This behavior often indicates an attempt to execute malicious commands or scripts as part of a post-exploitation or persistence mechanism.
Detects the spawning of administrative command-line utilities (cmd.exe, powershell.exe, wscript.exe, certutil.exe, mshta.exe) from processes related to Wyse Management Suite (WMS), Tomcat, or Java. This pattern is often indicative of exploitation of web applications or management services to gain command-line access on the underlying system.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launch suspicious child processes often associated with malicious command execution, such as command shells, scripting interpreters, or system utilities.
Detects post-compromise Active Directory reconnaissance activities using net.exe or wmic.exe to enumerate domain users, groups, computers, and sessions. The rule identifies anomalous behavior by monitoring for at least 3 distinct reconnaissance categories triggered by common scripting interpreters (PowerShell, cmd, pythonw, or node.exe) within a 5-minute window.
Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.
Detects SMB traffic patterns containing commands indicative of file obfuscation or permission tampering, specifically the use of 'attrib' to set hidden or system attributes, 'icacls' to deny access to files, or PowerShell execution with the '-WindowStyle Hidden' argument.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
This rule detects the execution of common scripting interpreters (powershell.exe, wscript.exe, cscript.exe, mshta.exe) where the command line arguments contain domains associated with the Dropbox API. This behavior is indicative of potential data exfiltration or the downloading of malicious payloads via a legitimate cloud storage service, a common technique for bypassing network filters and security controls.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
Page 90 of 213