Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
113
59
26
14
14
Contributors
78
29
27
23
19
Categories
169
136
66
57
39
Platforms
206
22
19
9
2
Products / Services
96
53
31
25
11
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload using the Tchopper tool.
Detects command line patterns associated with the threat actor Bonadan (also known as APT27, Emissary Panda, Lucky Mouse, Bronze Union, G0065). This rule identifies the use of certutil for decoding payloads, wmic for process creation, and schtasks for persistence in suspicious directories.
Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload. Tools like Tchopper can trigger this rule.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
Detects suspicious PowerShell execution via cmd.exe spawned by w3wp.exe (IIS worker process),
using encoded payloads that decode to indicators like 'spinstall0', '.aspx', or SharePoint layouts paths.
This technique has been observed in post-exploitation of SharePoint CVEs (CVE-2025-53770).
using encoded payloads that decode to indicators like 'spinstall0', '.aspx', or SharePoint layouts paths.
This technique has been observed in post-exploitation of SharePoint CVEs (CVE-2025-53770).
'This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br>
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Process executed from binary hidden in Base64 encoded file. Encoding malicious software is a.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code
Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects potential commandline obfuscation using known escape characters
Detects presence of a potentially xor encoded powershell command
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Ping Hex IP
Sigma
Detects a ping command that uses a hex encoded IP address
Detects presence of a potentially xor encoded powershell command
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.
Detects command line patterns used by BlackByte ransomware in different operations
Detects potential commandline obfuscation using known escape characters
Page 11 of 13