Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
Detects execution of various reconnaissance commands commonly used by Remote Access Trojans (RATs) to profile a target host. This includes querying security product status (AV/Defender), enumerating domain controllers, network adapters, port scanning, and gathering system hardware and software inventory.
Detects host-based reconnaissance activity involving system, network, and security software enumeration using standard administrative tools (e.g., PowerShell, WMI, netsh) that is followed by an outbound network connection to a known or suspicious implant check-in endpoint within a 30-minute window.
Detects second-stage reconnaissance patterns indicative of the VelvetCake framework. The rule identifies PowerShell execution that combines multiple discovery commands (system information, network configuration, process listing, file system inspection, and antivirus/security software enumeration) within a single execution sequence or related process events.
Detects malicious processes associated with the HVNC backdoor (e.g., UpdateAssistant.exe, SysMaintenance.exe) concurrently running alongside identified security product processes on the same device. This behavior suggests the malware is performing automated reconnaissance of installed security software to inform further compromise actions.
Detects malicious processes associated with the HVNC backdoor (e.g., UpdateAssistant.exe, SysMaintenance.exe) concurrently running alongside identified security product processes on the same device. This behavior suggests the malware is performing automated reconnaissance of installed security software to inform further compromise actions.
Detects anomalous network traffic patterns from the legitimate 'rnpkeys.exe' process when side-loaded from the 'ProgramData\keyroll' directory. The rule specifically looks for a sequence of connections matching initial C2 registration (TLV 0x01) followed by consistent, periodic beaconing (TLV 0x02) at an interval indicating automated task polling, rather than single-connection legitimate activity.
Detects a sequence of PowerShell commands consistent with the VelvetCake reconnaissance module, including enumeration of antivirus software via SecurityCenter2, system information, IP configurations, running processes, recent files, and drive mapping within a short timeframe.
Detects malicious PowerShell scripts that perform a sequence of reconnaissance activities, including security product enumeration via WMI (SecurityCenter2), system configuration discovery (ipconfig, systeminfo), process enumeration, recent file access, and drive mapping. This behavior is indicative of second-stage reconnaissance by threat actors to map the target environment.
Detects the execution of wmic.exe, powershell.exe, or pwsh.exe with command-line arguments related to querying antivirus products or security centers (e.g., AntiVirusProduct, SecurityCenter2). The rule focuses on executions originating from non-standard system paths (e.g., Temp, Users, AppData) or processes that lack a valid code signing signature, which is often indicative of reconnaissance by malicious actors.
Detects attempts by malicious software, specifically SloppyRAT, to query or modify Microsoft Defender settings by interacting with WMI classes like MSFT_MpPreference or MSFT_MpComputerStatus. This activity is indicative of efforts to disable security controls such as real-time monitoring to facilitate further malicious actions.
Detects host-enumeration activities performed by PowerShell processes, including anti-virus queries, system information gathering, network configuration checks, and file/drive enumeration, specifically when correlated with suspicious outbound network connections to common task-runner C2 infrastructure.
Detects a sequence of PowerShell commands consistent with the VelvetCake reconnaissance module, including enumeration of antivirus software via SecurityCenter2, system information, IP configurations, running processes, recent files, and drive mapping within a short timeframe.
Detects the execution of PowerShell commands intended to gather system information, specifically targeting the discovery of security software (anti-virus/EDR) and virtualization/sandbox artifacts. This behavior is indicative of an attacker performing environment reconnaissance to identify defensive controls or to determine if the payload is executing within an analysis environment.
Detects the execution of wmic.exe, powershell.exe, or pwsh.exe with command-line arguments related to querying antivirus products or security centers (e.g., AntiVirusProduct, SecurityCenter2). The rule focuses on executions originating from non-standard system paths (e.g., Temp, Users, AppData) or processes that lack a valid code signing signature, which is often indicative of reconnaissance by malicious actors.
This rule detects PowerShell commands that enumerate system, security, or virtualization-related artifacts. It specifically looks for the usage of WMI and PowerShell cmdlets (e.g., Get-Process, Get-WmiObject) to query for known analysis tools, debuggers, or virtualization software strings, which is a common behavior of malware attempting to identify and evade sandbox or analyst environments.
Detects the execution of common Windows command-line tools (such as cmd, powershell, or wmic) being used to query system information related to security configurations, antivirus status, firewall status, or installed security products. This behavior is indicative of an adversary performing reconnaissance to understand the defensive landscape of a compromised host.
Detects PowerShell scripts attempting to identify security software, virtualization environments, or sandbox analysis tools. The rule monitors for the enumeration of security processes, WMI queries for system hardware information (e.g., BIOS, Disk, Video Controller), and checks for registry keys or driver files associated with virtualization software (e.g., VMware, VirtualBox). This behavior is commonly observed in malware attempting to evade automated analysis.
Detects HVNC backdoor payload containing hardcoded AV/EDR process names combined with process enumeration APIs and a hex-suffixed mutex naming pattern, reducing false positives from generic AV name or API string matches alone
Detects HVNC backdoor payload containing hardcoded AV/EDR process names combined with process enumeration APIs and a hex-suffixed mutex naming pattern, reducing false positives from generic AV name or API string matches alone
Detects HVNC backdoor payload containing hardcoded AV/EDR process names combined with process enumeration APIs and a hex-suffixed mutex naming pattern, reducing false positives from generic AV name or API string matches alone
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Page 1 of 8