Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell commands commonly used for host reconnaissance (e.g., whoami, ipconfig, net group, systeminfo) combined with the use of PowerShell to perform an HTTP POST request to a suspicious external IP address (202.182.102.5), suggesting post-compromise reconnaissance data exfiltration.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects the execution of PowerShell with a Base64-encoded command line originating from Windows Explorer, a behavior consistent with the Potemkin Loader and ClickFix attack campaigns used to bypass string-based detection.
Detects the abuse of GitLab Runner to establish a C2 channel via malicious PowerShell script blocks. The rule identifies anomalous combinations of GitLab CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none, CI_JOB_NAME=run_command) and the execution of arbitrary commands (IEX $env:CMD) within PowerShell script block logging (Event ID 4104).
Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.
Detects anomalous child process execution (PowerShell, mshta, wscript, cscript, or cmd) spawned by common web browsers, which is consistent with the execution chain of CastleLoader malware delivered via EvilTokens PhaaS and ClickFix CAPTCHA lures. These lures typically trick users into copying and pasting commands into the Run dialog or directly into the shell.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects anomalous child process execution from common web browsers often associated with Browser-in-the-Browser (BitB) attacks. The rule correlates browser-spawned processes like PowerShell, cmd, or mshta with concurrent, suspicious network activity targeting login or account-related domains outside of expected conferencing platforms.
This rule detects when common web browsers or messaging applications spawn suspicious child processes such as command-line interpreters (cmd, powershell, wscript, mshta) or processes associated with remote access tools (NetSupport Manager). Such behaviors are often indicative of exploitation, malicious payload delivery, or unauthorized remote access.
Detects a host performing multiple distinct network reconnaissance commands in a short period, which is indicative of an attacker profiling the network configuration and environment of a compromised system.
Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.
Detects execution of virtualization-related tools and PowerShell cmdlets (New-VM, New-VHD) indicative of hypervisor management activities on Windows hosts. The rule monitors for processes such as vmconnect.exe, vmrun.exe, vmware.exe, and vmwp.exe, or specific PowerShell commands, excluding activity initiated by system-level accounts.
Detects potential CastleLoader delivery by monitoring for suspicious child process executions (e.g., PowerShell, cmd, mshta, wscript, cscript) spawned directly by common browser or email client parent processes. This behavior is indicative of a user interacting with a malicious phishing link or attachment as part of a malware delivery chain.
This rule detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe) or mshta.exe spawn shell processes (powershell.exe, pwsh.exe, cmd.exe) with suspicious command-line arguments. These arguments often indicate malicious activity such as downloading and executing code, using encoded commands, or hiding the execution window, which are typical indicators of a web-based delivery or exploitation attempt.
Page 91 of 213