Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects the execution of conhost.exe with the --headless parameter. This technique is actively used in ClickFix campaigns to silently execute clipboard-injected commands in the background without user awareness.
Detects the creation of PowerShell or batch scripts within the C:\ProgramData directory, which is a common location abused by malware for payload staging and persistence. The rule specifically looks for file creation events where the initiating process is cmd.exe or powershell.exe and the file extension is either .ps1 or .bat.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
Detects the creation of PowerShell or batch scripts within the C:\ProgramData directory, which is a common location abused by malware for payload staging and persistence. The rule specifically looks for file creation events where the initiating process is cmd.exe or powershell.exe and the file extension is either .ps1 or .bat.
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
Detects the creation and execution of specific temporary batch scripts (sstar-*.cmd) used by SStar Agent to execute shell commands on Windows endpoints. This rule specifically looks for 'cmd.exe' processes where the command line contains 'Temp' and matches the regex pattern 'sstar-[^"'\s]+\.cmd'.
Detects cmd.exe launched with the exact command line arguments used by LampoRAT (Boggy Serpens) to spawn a shell for payload execution. This specific command line includes '/e:ON', '/v:OFF', '/d', and '/c', which are characteristic of LampoRAT's dispatcher logic.
Detects instances where the Node.js runtime (node.exe) acts as a parent process to command shells or known sideloading executables observed in the Seedworm campaign.
Monitors the IIS worker process (w3wp.exe) for the execution of suspicious child processes such as cmd.exe, powershell.exe, and whoami.exe. This behavior is commonly associated with post-exploitation reconnaissance and execution via web shells, including those deployed during KnowledgeDeliver ViewState deserialization attacks.
Detects the SStar Agent malware executing remote shell commands by creating and executing ephemeral batch files. The malware creates a file named sstar-*.cmd in the %TEMP% directory and executes it using cmd.exe.
Identifies QuickAssist.exe launching cmd.exe to perform network and domain discovery commands. This behavior is indicative of post-exploitation reconnaissance following a remote support session, commonly seen in Nimbus RAT campaigns.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Detects the creation of conhost.exe running as NT AUTHORITY\SYSTEM, excluding expected system parent processes like csrss.exe and smss.exe. This behavior can be indicative of privilege escalation or an interactive system shell delivery, as seen in exploits like RedSun (CVE-2026-41091).
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
This rule detects a common worm behavior where 'explorer.exe' spawns 'cmd.exe' with both 'start' and 'exit' commands in the command line. This pattern is often used by worms like Phorpiex and Ippedo to launch a payload and then immediately close the shell, potentially to evade detection. The rule specifically looks for 'explorer.exe' as the parent process of 'cmd.exe' and requires both 'start' and 'exit' keywords in the 'cmd.exe' command line. It filters out legitimate uses involving 'msiexec', 'installutil', 'dotnet', 'npm', or 'node' in the command line.
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
Detects the execution of the VSCode CLI (code.exe) with the 'tunnel' argument, particularly when executed from uncommon directories like ProgramData or Users\Public, or when automated via piped input. This technique is actively abused by Kimsuky to establish covert C2 channels that bypass traditional network detections.
Monitors for Windows cmd.exe executions leveraging '//c' to run hidden batch files. This matches the Metasploit module's evasion technique for bypassing MSYS2 mangling on Windows Gogs installations during the argument injection exploit.
Detects the specific command execution wrapper used by the Rust-based HelloDoor malware (part of the Kimsuky PebbleDash cluster). The malware sets the code page to 65001 (UTF-8), suppresses output to nul, and chains the execution of a payload using cmd.exe.
Page 58 of 74