Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Detects the China Chopper web shell spawning CMD from IIS (w3wp.exe) with suspicious command line patterns.
Detects the execution of the 'whoami' command when its base64 encoded string ('d2hvYW1p') appears in a process command line. This pattern is often associated with web shells or other malicious activity attempting to gain system information.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule detects the execution of common command-line interpreters (powershell.exe, cmd.exe, cscript.exe) or generic executables from suspicious user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. It specifically excludes 'msbuild.exe' and 'dotnet.exe' to reduce false positives. A high count (3 or more) of such events within an hour for a given computer and user is flagged as an anomaly, indicating potential malicious activity like malware execution or persistence.
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
Detects attempts to exploit the Windows Search URI handler vulnerability (CVE-2023-29357) which can lead to NTLM credential leaks. This rule specifically looks for process command lines that invoke the 'search' or 'search-ms' URI scheme with a 'crumb=location:' parameter pointing to an UNC path, indicating an attempt to coerce NTLM authentication.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) spawns unexpected command shells or script interpreters. This is a strong indicator of post-exploitation activity following CVE-2026-41089 exploitation.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
Suspicious Conhost Headless Execution
Cortex XDR
Detects the execution of conhost.exe (or conhost.ext) with the --headless parameter, a technique used in ClickFix campaigns to silently execute clipboard-injected commands.
This rule detects unusual child processes spawned from critical Windows system binaries (svchost.exe, lsass.exe, csrss.exe, winlogon.exe, system.exe). Specifically, it looks for these parent processes launching command-line interpreters or scripting engines like PowerShell, cmd, Python, or Java, excluding common legitimate child processes such as conhost.exe, csc.exe, taskkill.exe, and services.exe. A count of 2 or more such events within an hour on the same computer triggers an alert, indicating potential malicious activity like privilege escalation or execution.
This rule detects the execution of common command-line interpreters (powershell.exe, cmd.exe, cscript.exe) or generic executables from suspicious user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. It specifically excludes 'msbuild.exe' and 'dotnet.exe' to reduce false positives. A high count (3 or more) of such events within an hour for a given computer and user is flagged as an anomaly, indicating potential malicious activity like malware execution or persistence.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
Page 57 of 74