Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell commands intended to suspend BitLocker encryption. Adversaries may attempt to disable or suspend disk encryption to facilitate data exfiltration or to modify protected system files.
Detects the use of PowerShell to perform DNS lookups for TXT records followed by immediate command execution, such as using 'Invoke-Expression' or 'Start-Process'. This pattern is frequently indicative of fileless command-and-control (C2) communication where stage-payload commands or scripts are retrieved via DNS TXT records to evade detection.
Detects suspicious activities associated with malicious npm package installations, including Node.js spawning shells during lifecycle hooks (preinstall, postinstall), connections to known command-and-control (C2) domains used in software supply chain campaigns, and the creation of artifacts within the node_modules directory.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects Microsoft Office applications (Word, Excel, PowerPoint) and WordPad spawning command-line interpreters (mshta, wscript, cscript, cmd, powershell, pwsh). This behavior is often associated with macro-based malware or malicious document attachments attempting to execute scripts or shell commands to facilitate further infection stages.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects potential BaoLoader drive-by compromise attempts by monitoring two stages: first, the creation of executable files in temporary or application data directories by browser processes; and second, the execution of command-line shells by processes running from those same directories where the browser acted as the grandparent.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Detects the execution of wscript.exe spawning a child powershell.exe process with arguments specifically configured to execute a script file starting with 'ps_' from the 'C:\Temp' directory. This behavior is highly characteristic of JScript droppers commonly associated with malicious email attachments that write and launch secondary payloads silently in the background.
This rule detects PowerShell commands that perform XOR decryption of an embedded payload using the hardcoded key 'Pussecretvk456' and subsequently use [System.Reflection.Assembly]::Load to reflectively load the resulting .NET assembly into memory. This behavior is indicative of fileless execution patterns commonly observed in the LokiBot and Amadey malware families.
Detects instances where explorer.exe spawns command-line utilities (cmd.exe, powershell.exe, mshta.exe) with command-line arguments indicative of file downloading or remote execution (e.g., curl, certutil, bitsadmin, Invoke-WebRequest). This pattern is often associated with ClickFix social engineering attacks, where a victim is tricked into pasting malicious commands directly into the Windows Run dialog.
Detects instances where Windows Script Host (wscript.exe or cscript.exe) spawns PowerShell or CMD. This pattern is commonly observed in malicious document loaders or script-based droppers, such as those associated with the LokiBot malware, which use JScript files to initiate secondary payload execution.
Detects instances where PowerShell is invoked with an execution policy bypass flag to copy the 'curl.exe' binary from its legitimate System32 location to user-writable directories (such as AppData, Temp, or Public folders) and renaming it. This activity is often associated with adversaries attempting to evade security controls by masquerading legitimate system utilities.
Detects the execution of PowerShell scripts from the Windows Temp directory using common evasion flags (-NoProfile, -ExecutionPolicy Bypass, -WindowStyle Hidden). This pattern is consistent with loaders attempting to maintain persistence while obfuscating their execution context, specifically associated with steganographic malware campaigns.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
Detects the ClickFix social engineering technique where a user is coerced into copying and executing a malicious script from a web browser. The rule identifies instances where common web browsers spawn script interpreters such as powershell.exe, cmd.exe, mshta.exe, or wscript.exe, which is characteristic of the user pasting malicious commands into a command prompt interface.
Detects the execution of the NetSupport Manager remote access tool (client32.exe) when spawned by web browsers or script interpreters such as PowerShell or MSHTA. This behavioral pattern is frequently associated with malicious delivery chains including ClickFix and CastleLoader, where users are social engineered into downloading or executing suspicious payloads.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Page 99 of 213