Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
38
15
6
2
1
Contributors
10
8
7
6
5
Categories
34
19
12
12
10
Platforms
54
11
7
3
1
Products / Services
15
9
8
6
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
Detects the registration of the gitlab-runner Windows service as a custom Event Log provider under the Application registry key. This registry modification occurs during the installation of the GitLab Runner service. When observed on endpoints not intended for CI/CD operations, this activity may indicate an adversary is installing a GitLab Runner for use as a C2 implant.
Detects evidence of PowerShell execution occurring within a GitLab CI runner environment that exhibits characteristics of command-and-control (C2) activity. This rule monitors PowerShell Script Block Logging (Event ID 4104) for indicators such as specific CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none), static job names associated with known exploitation patterns (e.g., CI_JOB_NAME=run_command), and the dynamic execution of commands using Invoke-Expression (IEX) on environmental variables.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) directly spawned by a GitLab Runner process. This behavior is associated with the abuse of GitLab CI/CD runners as a Command and Control (C2) mechanism to execute unauthorized commands on build infrastructure.
Detects instances where a user account performs a device configuration change (such as updating compliance policies) followed by a potentially destructive operation (Wipe, Retire, or Delete) on the same device or entity within a 6-hour window. This behavior often suggests unauthorized administrative activity or a malicious insider attempting to disable security controls before removing access or destroying data.
Detects the use of package management tools (pip, npm, yarn) to install packages when initiated by common scripting interpreters or shells (python, cmd, powershell) in environments likely associated with CI/CD pipelines or automated workflows. The rule intentionally excludes jupyter and ipython interactive environments, suggesting it targets non-interactive or automated deployments.
Detects processes spawned by the GitLab Runner binary (gitlab-runner-windows-amd64.exe) where the working directory is set to the GitLab CI/CD build folder (C:\GitLab-Runner\builds\). This activity is indicative of automated job execution which, when occurring on non-developer or unauthorized hosts, may represent command dispatch by an attacker using a rogue or compromised runner for C2 operations.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
Detects the abuse of GitLab Runner to establish a C2 channel via malicious PowerShell script blocks. The rule identifies anomalous combinations of GitLab CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none, CI_JOB_NAME=run_command) and the execution of arbitrary commands (IEX $env:CMD) within PowerShell script block logging (Event ID 4104).
This rule detects the execution of processes in CI/CD environments (such as runners, Jenkins, or GitLab) where the environment variable 'GEMINI_TRUST_WORKSPACE' is explicitly set to 'true'. This configuration is often used to grant elevated trust or access to workspace files during CI/CD workflows, which could be abused by an attacker to execute arbitrary code or access sensitive data if they can control the pipeline execution or workspace state.
This rule detects repeated execution of 'maven' or 'gradle' commands on a system within a one-hour window. A high count (5 or more) of these commands from the same account on the same computer within an hour could indicate unusual development activity, automated build processes, or potentially malicious activity related to software supply chain compromise or development environment abuse.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
This rule detects the execution of processes in CI/CD environments (such as runners, Jenkins, or GitLab) where the environment variable 'GEMINI_TRUST_WORKSPACE' is explicitly set to 'true'. This configuration is often used to grant elevated trust or access to workspace files during CI/CD workflows, which could be abused by an attacker to execute arbitrary code or access sensitive data if they can control the pipeline execution or workspace state.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
Detects FleetDeck Go-compiled installer
Page 1 of 4