Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
Detects suspicious command line execution by `cmd.exe` that includes both a URL (http or https) and the `%AppData%` environment variable in its parameters. This pattern is often observed in droppers, particularly those using JavaScript or VBScript to execute PowerShell commands.
Detects the use of `cmd.exe` to read content from standard input using the `<` redirection operator. This technique can be used by adversaries to execute commands or scripts from a file, effectively piping the file's content as input to `cmd.exe`.
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Detects various execution patterns of the CrackMapExec pentesting framework
Yara rule that detects BlackBasta ransomware.
Yara rule that detects Eternity ransomware.
Win32 Virus Negt
YARA
Yara rule that detects Negt virus.
Page 74 of 74