Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects executable files saved to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints when the file has no company name in its PE version information. Commercial software almost always carries this field, while malware, masqueraded tools and quick custom builds often do not. Detection relies on file signature rather than extension. Portable utilities and internal tools also match, so triage by hash, writing process, file path and download source.
Detects Portable Executable (PE) files written to a user's Downloads folder on Windows endpoints. CrowdStrike identifies PE files by file signature, so renamed or extensionless executables are caught as well as .exe files. Downloads is a common landing spot for payloads from phishing links and drive-by downloads. Most hits are legitimate installers, so use the rule for hunting or as a pivot. To triage, review the file name, company name, hash, writing process and download source.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Detects Trays.exe started with the -tray argument from a Trays subfolder or a batch script, as observed in the RareWolf BAT dropper ahead of a silent AnyDesk installation.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Correlates internet-origin executable creation with subsequent execution by Windows shell processes using matching device, file path and SHA1 hash within a five-minute timeframe.
Detects PowerShell processes spawned via shortcut files (lnk) using suspicious command-line parameters that subsequently create both a text file and a Discord-named executable on the same device within a 10-minute window.
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects when common office applications (Word, Excel, PowerPoint, Outlook, OneNote, etc.) or archive utilities/PDF readers spawn command-line interpreters or scripting engines (cmd.exe, powershell.exe, wscript.exe, etc.), which is a common indicator of phishing document execution or malicious archive extraction.
Detects a renamed PSF-signed pythonw.exe (with an original file name of pythonw.exe but a different on-disk name) launched from a user-writable path under Users. The command line consists only of its own path, which is consistent with ._pth based path configuration abuse for loading attacker code stealthily.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Detects process creation events where common Office applications (Word, Excel, PowerPoint, Outlook) or archive/reader utilities (Acrobat, WinRAR, 7-Zip) act as the parent process to command-line interpreters, scripting engines, or administrative tools (such as cmd, powershell, wscript, cscript, mshta, rundll32, and others). This behavior is commonly associated with phishing attacks, macro execution, or exploitation of file formats leading to code execution.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Page 1 of 86