Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects anomalous activity where a process or user attempts to stop or disable multiple security-related services (e.g., Windows Defender, Sysmon, EDR agents) within a short window. This behavior is indicative of an adversary attempting to impair defensive monitoring and protection tools during a compromise.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
Detects suspicious PowerShell command-line activity commonly associated with malicious scripts, including execution bypass (e.g., -ep bypass), the use of .NET BigInteger for potential obfuscation, and downloading files via Invoke-WebRequest to the temp directory. The rule further increases fidelity by identifying if the parent process is a common execution vector such as explorer.exe, wscript.exe, or mshta.exe.
This rule correlates process execution patterns to detect a potential malicious document or file download chain. It monitors for child processes spawned by common document viewers (Adobe Acrobat, Word, Excel, PowerPoint) or browsers (Edge, Chrome, Firefox) that subsequently launch suspicious interpreters (cmd, powershell, wscript) or tools (7z, rar), finally leading to potentially malicious payload execution within common user-writable directories, or obfuscated PowerShell command-line execution.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
This rule detects potentially malicious child processes spawned by Amazon Q or VS Code language server processes. It monitors for suspicious shell command-line invocations (e.g., bash, sh, cmd.exe) or tools (npx, python) immediately following the activation of language server processes, specifically looking for patterns associated with the unauthorized auto-loading or execution of Model Context Protocol (MCP) configuration files or utilities, potentially related to vulnerability patterns involving workspace-based execution.
Detects the Ghidra reverse engineering suite spawning suspicious child processes such as command shells, scripting interpreters, or network utilities. This activity often indicates an attempt to automate reverse engineering tasks or interact with the system in an unintended manner by potentially malicious scripts or plugins.
Detects potential abuse of System Informer's phsvc service for privilege escalation or execution via rundll32, as well as unauthorized child process spawning by the SystemInformer process. This behavior is associated with proof-of-concept exploits targeting the System Informer service.
Detects the execution of PowerShell with suspicious flags, obfuscation, or download cradles often used by the SystemBC/Coroxy malware to facilitate second-stage payload delivery and C2 activity.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
Detects user-initiated PowerShell execution patterns associated with Woodgnat social engineering campaigns (ClickFix, FileFix, CrashFix). The rule monitors for PowerShell processes spawned by common communication and web browsing applications (Microsoft Teams, Chrome, Edge, Firefox) or script interpreters (mshta, wscript) that utilize obfuscation or non-interactive flags common in these attack vectors.
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
This rule detects suspicious process execution patterns that are characteristic of fileless malware execution or malicious script handling. It specifically targets PowerShell commands using ReadAllText to read script content from stdin/env:0, the use of Sysnative paths for architectural bypasses, and the execution of setup.cmd files from 7Zip extraction directories.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects use of scheduled tasks to break process trees and hide parent relationships
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Page 92 of 213