Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects the execution of 'cmd.exe' with a command line that includes 'type', '.pdf', 'more', and 'findstr'. This specific combination of commands is indicative of a technique used by AsyncRAT to extract and execute malicious code hidden within a decoy PDF file by reading specific line ranges.
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Identifies when DeepLoad target processes (LockAppHost.exe, makecab.exe, Magnify.exe) spawn child processes like shells (cmd.exe, powershell.exe, whoami.exe, net.exe), indicating successful injection and post-exploitation execution. This behavior is associated with the DeepLoad malware.
Detects the execution of 'update.bat' from the Temp directory with a minimized window, typically indicating a hidden or background execution of a batch script. This pattern is often used by malware or unwanted applications to perform updates or other actions discreetly.
Detects commands querying video controller names, memory, or GPU vendor information, commonly used by adversaries to select a compatible mining payload for cryptojacking campaigns.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
Detects execution of 'certificado.exe' or 'crtf.exe' leading to the creation of the batch script 'vvvv.cmd' or 'help.bat'. This activity is associated with the UnregStealer malware.
Detects SQL Server executing OS commands via xp_cmdshell, a known privilege escalation vector. This rule specifically looks for 'sqlservr.exe' as the initiating process and 'xp_cmdshell' in the process command line.
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Detects cmd.exe spawned from web server process
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects the execution of temporary executables (from common temporary directories like 'temp' or 'appdata\local\temp') that are launched with a command line containing a numeric argument followed by a long Base64-like token. This pattern is often indicative of malware loaders or droppers attempting to evade detection by using obfuscated arguments.
Identifies cmd.exe executing a batch script named 'vvvv.cmd' which is checking for the presence of the 'u.dat' reinfection guard file in the Public\Documents folder before execution. This behavior is associated with the UnregStealer malware.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Page 56 of 74