Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.
Detects potential process patterns related to Cobalt Strike beacon activity. This includes specific command-line executions like 'whoami' from the C:\Temp\ directory, or 'cmd.exe /c echo' piping output to a named pipe when the parent process is 'runonce.exe' or 'dllhost.exe'. It also identifies 'conhost.exe' being spawned with particular arguments in conjunction with these suspicious parent command lines.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.
This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability (CVE-2020-10189) by monitoring for suspicious child processes spawned by the Java executable associated with Desktop Central. This exploitation often leads to the execution of command-line utilities for further compromise.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
Detects the use of Jlaive, a hack tool, to execute assemblies in a copied PowerShell instance. This technique involves using `xcopy.exe` to copy `powershell.exe` or `pwsh.exe` to a new name ending with `.bat.exe`, and then using `attrib.exe` to set system and hidden attributes on this file, likely to evade detection and execute malicious code.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects Rorschach ransomware execution activity by looking for specific system utilities being executed with a distinct command-line string ('11111111'). The utilities include bcdedit.exe, net.exe, net1.exe, netsh.exe, wevtutil.exe, and vssadmin.exe, which are commonly abused by ransomware for defense evasion, system modification, and data destruction.
Detects a specific broken command line argument 'choice /t %d /d y /n >nul' used by the Goofy-Guineapig backdoor, as detailed in the NCSC report. This command is likely an attempt to introduce a delay or interact with a prompt in a non-standard way, which could indicate malicious activity.
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects potential path traversal attempts via cmd.exe, which could indicate command or argument confusion/hijacking. The rule looks for cmd.exe being executed with command line arguments containing '/c', '/k', or '/r' and a path traversal sequence like '/../../'.
Detects the use of Cobalt Strike commands entered into the command shell. This rule specifically looks for common Cobalt Strike post-exploitation commands such as 'psinject', 'spawnas', 'make_token', 'remote-exec', 'rev2self', 'dcsync', 'logonpasswords', 'execute-assembly', and 'getsystem' when executed via cmd.exe. This often indicates an operator error where Cobalt Strike commands are mistakenly typed directly into a compromised system's command prompt instead of the Cobalt Strike beacon console.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Page 73 of 74