Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where the LINE messaging application (LINE.exe) initiates child processes commonly associated with malware delivery, such as command-line shells, script interpreters, and archive utilities. This pattern is often indicative of TA4922 activity, which leverages themed lures (HR, payroll, tax) delivered via the platform to execute malicious payloads.
Detects instances where critical Windows system processes (svchost.exe or lsass.exe) spawn suspicious child processes. This pattern often indicates process injection or unauthorized activity where an adversary uses these legitimate, high-privileged processes as a parent to execute malicious payloads, bypass security controls, or maintain persistence.
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from common public file sharing and code repository sites, which is a known technique for adversaries to stage or download malicious payloads.
Detects Microsoft Outlook spawning a command-line interpreter (cmd.exe or powershell.exe) followed by a network connection originating from that interpreter within a 5-minute window. This behavior is highly suspicious and often indicative of malicious macro execution or exploit delivery via email attachments leading to command-and-control activity.
This rule detects potential tunnel creation using PowerShell. It identifies network connections from PowerShell processes to common SSH (22) or Tor (9001, 9050) ports, as well as PowerShell script block activity involving socket connections directed at .onion domains, SSH keys, or authorized keys files, which may indicate remote access tunneling or command-and-control communication.
This rule detects potentially unauthorized or suspicious outbound network connections to common Generative AI service APIs (OpenAI, Anthropic, Mistral) originating from command-line interpreters (cmd.exe, powershell.exe) or python.exe instances running from temporary directories, which could indicate data exfiltration or the use of AI tools for malicious automation.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects the execution of PowerShell or pwsh that originates from an interactive parent process like explorer.exe or cmd.exe. The rule identifies suspicious command-line patterns containing 'IEX', 'Invoke-Expression', 'Invoke-WebRequest', 'iwr', or 'IRm', while excluding encoded commands, which is indicative of potential malicious clipboard-paste activity or manual attacker intervention.
Detects the creation of scheduled tasks designed for persistence, typically used by Operation Poisson (e.g., Demon agent, Python keyloggers). The rule identifies tasks that execute script interpreters (powershell.exe, cmd.exe, wscript.exe, cscript.exe, python.exe, pythonw.exe) with indicators of suspicious intent, such as hidden windows (/WindowStyle Hidden, /c) or elevated privileges (HighestAvailable, HighestPrivilege, AtLogon).
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects attempts to establish persistence by modifying registry run keys (Run or RunOnce) to execute scripting interpreters like PowerShell, cmd, or wscript. The rule looks for at least two such events within an hour on the same device and registry key, indicating potential malicious activity.
Page 96 of 213