Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
This rule detects the creation of new Windows services where the executable path is suspicious. Suspicious paths include common temporary or user-writable directories like `Users\Public`, `ProgramData`, `AppData`, or `Windows\Temp`. Additionally, it flags services that directly execute `cmd.exe` or `powershell.exe` with suspicious arguments (e.g., encoded commands, hidden windows, or `/c` for command execution), or `rundll32.exe` from suspicious paths. It also identifies services with very short, alphanumeric names, which could indicate an attempt at masquerading.
Detects cmd.exe execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Water Gamayun Group is actively exploiting Windows MMC vulnerability to deliver hidden PowerShell payloads and final malware loaders.
Detects the execution of a command pattern associated with malicious .lnk files used in the SERPENTINE#CLOUD campaign. The threat actor uses a .lnk file to launch cmd.exe, which then uses robocopy to download a .wsf script from a WebDAV share hosted on a Cloudflare Tunnel, and finally executes it with cscript.exe.
Detects the spawning of a Windows command shell, powershell, or reconnaissance tools by the IIS worker process (w3wp.exe). This behavior is a strong indicator of a successful web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an attacker gains remote code execution. Also detects the WSUS Service as the parent process spawning another process.
Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.
Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors
Detects the creation and subsequent hidden execution of a batch file, a technique used by XWorm to stage malicious code. The rule looks for a .bat file created in a temporary or user profile directory, which is then immediately run invisibly using the 'cmd /c start "" /min' command.
This detection identifies instances where Rundll32.exe or svchost.exe are executed by processes initiated through .lnk (shortcut) files, particularly those masquerading as PDFs or containing suspicious keywords like "申報物品清單" (Declaration of Items List). It further filters for command lines referencing potentially malicious file types such as .dll, .dat, .jpg, .zip, or .png, and checks for execution from common user or system directories often abused by malware (e.g., Temp, AppData, Public). This behavior is indicative of initial access or execution stages of malware campaigns, such as those involving the ToughProgress malware family.
Detects child processes spawned by "MicrosoftEdgeUpdateCore.exe" when it is located in the AppData directory. This behavior is characteristic of the LeakyStealer malware executing downloaded payloads or system commands as part of its post-exploitation activities.
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects command line parameters used by Koadic hack tool
Detects a command-line pattern using a ping loopback command to create a delay, a technique used by malware like DarkTortilla/CHAMELEON#NET to evade automated sandbox analysis.
Detects the spawning of command-line interpreters (`cmd.exe` or `powershell.exe`) from processes associated with Windows Server Update Services (WSUS), such as `w3wp.exe` (IIS worker process for WSUS) and `wsusservice.exe`. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2025-59287, where attackers gain remote code execution on the WSUS server.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
A critical remote code execution vulnerability, CVE-2025-59287, affects Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute arbitrary code via unsafe deserialization in the AuthorizationCookie.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Actively exploited since October 2025, this flaw targets WSUS servers on ports 8530/8531, often leaving forensic artifacts like modified SoftwareDistribution.log files and suspicious process chains involving w3wp.exe or wsusservice.exe spawning cmd.exe, powershell.exe, or net.exe.
The provided KQL query for Microsoft Defender XDR correlates network, file, and process events to detect exploitation attempts.
Page 64 of 74