Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects suspicious process creation patterns that may indicate FIN7 exploitation activity. Specifically, it looks for `cmd.exe` being spawned by `notepad++.exe` or `notepad++.exe` being spawned by `rdpinit.exe`. These process relationships are indicative of potential post-exploitation actions after initial access, possibly via compromised RDP credentials as described in the referenced Google blog.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
The analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUID, process name, parent process, and command-line executions. This activity is significant because it may indicate an attempt to execute unauthorized commands or scripts, often a precursor to further malicious actions. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
This analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. It detects command-line executions where `cmd.exe` uses `echo` to write to a named pipe, such as `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant as it indicates potential privilege escalation attempts. If confirmed malicious, attackers could gain elevated privileges, enabling further compromise and persistence within the environment.
The analytic detects the execution of cscript.exe or wscript.exe processes initiated by cmd.exe. This activity is significant as it may indicate script-based attacks or administrative actions that could be leveraged for malicious purposes. If confirmed malicious, this behavior could allow attackers to execute scripts, potentially leading to code execution, privilege escalation, or persistence within the environment.
The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services.
The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system.
This analytic identifies instances where the CrushFTP service process (crushftpservice.exe) spawns shell processes such as cmd.exe or powershell.exe. This behavior is unusual for CrushFTP during normal operations and could indicate a successful exploitation of vulnerabilities, such as CVE-2025-31161, allowing an attacker to execute arbitrary commands with the privileges of the CrushFTP service.
The analytic detects potentially malicious command lines using a pretrained machine learning text classifier. It identifies unusual keyword combinations in command lines, such as "streamreader," "webclient," "mutex," "function," and "computehash," which are often associated with adversarial PowerShell code execution for C2 communication. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command lines longer than 200 characters. This activity is significant as it can indicate an attempt to execute malicious scripts, potentially leading to unauthorized code execution, data exfiltration, or further system compromise.
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects the creation of files with scripting or executable extensions by the MySQL daemon process. This activity could indicate the abuse of MySQL User Defined Functions (UDFs) to download and execute malware, often as part of a broader compromise or to establish persistence.
Detects the execution of a system command, specifically 'cmd.exe', initiated by the ScreenConnect remote management service. This rule looks for 'cmd.exe' being spawned as a child process of 'ScreenConnect.ClientService.exe' and further refines the detection by looking for command lines that include the pattern '\TEMP\ScreenConnect\', which is indicative of temporary script execution by ScreenConnect.
Detects the execution of a system command via the ScreenConnect RMM service.
Detects command execution events originating from ScreenConnect, a legitimate remote administration tool. This rule specifically looks for Windows application log events where ScreenConnect is the provider and an event ID of 200 indicates a command of a certain length was executed. This activity can be indicative of an attacker using ScreenConnect for malicious purposes, such as executing arbitrary commands on a compromised system.
Detects file being transferred via ScreenConnect RMM
Detects command execution via ScreenConnect RMM
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
Detects command line parameters indicative of Koadic hack tool execution. Specifically, it looks for 'cmd.exe' being executed with '/q', '/c', and 'chcp' in the command line, which is a known pattern used by Koadic for stager execution.
This rule detects the execution of the 'xp_cmdshell' stored procedure within Microsoft SQL Server. 'xp_cmdshell' allows SQL Server to execute operating system commands directly, which is a common technique used by attackers for privilege escalation, lateral movement, and persistence within a compromised environment. The detection specifically looks for EventID 33205 in the application log, indicating a SQL Server event, and checks for the presence of 'object_name:xp_cmdshell' and 'statement:EXEC' in the event data, confirming the execution of this procedure.
Page 72 of 74