Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
Detects the execution of an executable or script file from the NETLOGON share. This behavior was observed during the deployment of the Obscura ransomware and is a strong indicator of lateral movement or malicious deployment via Group Policy.
Detects scenarios where an attacker inject a payload into SQL Server in order to obtain a remote shell.
Detects scenarios where an attacker deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.
Detects if an attacker open a privileged CMD shell while accessing to an Azure virtual machine via serial cable.
The analytic detects the use of `cmd.exe /c` or `cmd.exe /k` to execute commands. This technique is often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized command execution. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
This rule detects commands executed via the Run dialog (Win+R), which is often used by attackers or malicious scripts to launch tools like PowerShell, cmd, or other malicious payloads. It specifically looks for modifications to the 'RunMRU' registry key by 'explorer.exe' that contain suspicious keywords or patterns indicative of command execution, especially in scenarios like ClickFix-style attacks where users are tricked into running commands.
This KQL rule detects commands executed via the Run dialog by monitoring changes to the "Runmru" registry key. This key stores a history of commands entered into the Run dialog. Attackers or malicious scripts often use this method to launch tools like PowerShell, cmd, or malicious payloads, particularly in social engineering attacks where users are tricked into running commands.
This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.
Detects instances where NodeJS (node.exe) spawns the Command Processor (cmd.exe) to execute the 'reg add' command. This behavior is a known persistence technique used by the NodeInitRAT backdoor, associated with the Mocha Manakin threat actor, to add a run key to the Windows Registry.
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
The following analytic identifies child processes spawned by vmtoolsd.exe, the VMWare Tools service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as CVE-2023-20867. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system.
This rule detects suspicious process and file activity that may be indicative of a crypto-miner or other malware. Specifically, it looks for the execution of VBScript files with a specific naming convention ('x#######.vbs') via wscript, or batch files with a similar naming convention initiated by wscript. Additionally, it unions these process events with file events where 'printui.exe' or 'printui.dll' are found in 'C:\Windows \System32\'. The rule then summarizes these events by device and flags if both process and file events are observed on the same device within the specified timeframes, suggesting a multi-stage activity.
Detects the execution of mshta.exe spawning a command shell (cmd.exe) to download a remote file. This behavior is indicative of malicious HTA files used to deliver malware, as seen in campaigns distributing Epsilon Red ransomware.
Detects the execution of a shell process (like cmd.exe or powershell.exe) spawned by the Microsoft HTML Application Host (mshta.exe). This behavior is often associated with malicious HTA files that use scripting objects like "WScript.Shell" to execute arbitrary commands, as seen in campaigns distributing Epsilon Red ransomware.
This detection identifies suspicious command-line activity (e.g. powershell, cmd.exe, wsl.exe, etc.) that is initiated via explorer.exe, suggesting potential user-initiated execution (e.g., copy-paste into Run dialog or file association abuse). This technique is commonly used in social engineering campaigns or malware execution patterns, and is associated with the campaign tag: fileFix.
Detects the execution of an HTA file (via mshta.exe) that spawns a command prompt to silently download and execute a remote payload using curl. This behavior is consistent with the Epsilon Red ransomware campaign that uses malicious HTA files with embedded JScript to run shell commands.
Detects suspicious activity related to Storm-2603 ransomware operations, including ToolShell exploitation, DLL sideloading, BYOVD AV-killers, and multi-ransomware deployment (LockBit, Warlock).
This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.
Page 66 of 74