Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
103 detections
Filters
Last updated
All Time
Detection languages
45
36
8
6
4
Contributors
21
16
16
10
5
Categories
82
37
28
19
9
Platforms
99
3
1
1
Products / Services
43
27
20
11
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects network traffic containing the strings "SW_HIDE" and "CreateProcess" within file data in an HTTP response. This combination suggests an attempt to execute a process with a hidden window, which is a common technique used by malicious software to evade detection.
Detects the execution of conhost.exe with the --headless parameter. This technique is actively used in ClickFix campaigns to silently execute clipboard-injected commands in the background without user awareness.
Detects the use of `conhost.exe` with the `--headless` flag to stealthily execute the Deno runtime (`deno.exe`). This technique is utilized by the DinDoor backdoor to establish hidden persistence on compromised endpoints.
Detects execution of Chromium based browser in headless mode
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.
The "--headless" flag hides the windows from the user upon execution.
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags.
To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.
To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.
Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control
Detects suspicious command lines used in Covenant luanchers
Detects the execution of AdvancedRun utility
A recent worldwide cyberattack campaign has been detected involving the npm package axios. Malicious versions were reportedly used to deploy a remote access trojan during installation, which may impact developer workstations and CI/CD environments.
Detects the initial CTRL execution chain where a malicious LNK launches hidden PowerShell, writes ms-settings UAC bypass registry keys including DelegateExecute, then starts fodhelper.exe. This rule correlates process events for PowerShell executing with a hidden window style and obfuscated commands, registry modifications to the ms-settings UAC bypass key, and the subsequent execution of fodhelper.exe.
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
Detects the use of the PowerShell 'Start-Process' cmdlet with parameters ('-WindowStyle Hidden', '-NoNewWindow') to execute a process without a visible window. This specific execution pattern was used by the Windows payload (msinit.exe) of the 'ambar-src' malware to evade user detection.
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
Detects Microsoft Edge launched with command-line arguments used to hide the browser window (headless mode or off-screen positioning) in conjunction with a Base64-encoded HTML data URI. This technique was observed in the APT28 "Operation MacroMaze" campaign to execute payloads stealthily.
Detects PowerShell execution where the window is hidden, combined with suspicious commands such as encoded payloads, direct execution of expressions (iex, Invoke-Expression), web requests (DownloadString, iwr, Invoke-WebRequest), base64 decoding (FromBase64String), or execution policy bypass. The rule specifically excludes legitimate application package management operations involving 'AppxPackage' and certain Visual Studio Code (VS Code) installer and process management activities.
This rule detects suspicious command-line activity involving 'conhost.exe' running in headless mode, combined with specific keywords often associated with malware or malicious scripts. The presence of '--headless' with other suspicious strings like 'svchost.exe', 'certutil -decode', common temporary directories, or specific file extensions/initiating processes (cmd.exe, powershell.exe, curl) suggests an attempt to execute hidden or obfuscated malicious code. This pattern is frequently observed in various stages of an attack, including execution, persistence, and defense evasion.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Page 4 of 5