Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
103 detections
Filters
Last updated
All Time
Detection languages
45
36
8
6
4
Contributors
21
16
16
10
5
Categories
82
37
28
19
9
Platforms
99
3
1
1
Products / Services
43
27
20
11
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.
Detects the execution of Chromium-based browsers (Brave, Chrome, MS Edge, Opera, Vivaldi) in headless mode. This behavior can be abused by adversaries for various purposes, including web scraping, automated data exfiltration, or as part of command and control activities, often to avoid displaying a visible browser window to the user.
Detects the execution of Chromium-based browsers (Brave, Chrome, MS Edge, Opera, Vivaldi) in headless mode using the "dump-dom" command-line argument. This technique can be used to download files or extract content from web pages without a visible browser interface, often for malicious purposes like data exfiltration or staging.
The analytic detects headless browser activity accessing mockbin.org or mocky.io. It identifies processes with the "--headless" and "--disable-gpu" command line arguments, along with references to mockbin.org or mocky.io. This behavior is significant as headless browsers are often used for automated tasks, including malicious activities like web scraping or automated attacks. If confirmed malicious, this activity could indicate an attempt to bypass traditional browser security measures, potentially leading to data exfiltration or further exploitation of web applications.
This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
Detects the execution of PowerShell commands from a headless ConHost process. The '--headless' flag is used to hide the console window from the user, which can be leveraged by adversaries for stealthy execution.
Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.
Detects PowerShell being executed with the '-WindowStyle Hidden' flag from a Windows Scripting Host parent process (wscript.exe or cscript.exe). This is a common technique used by malware, such as Katz Stealer, to run malicious scripts stealthily after being dropped by JavaScript.
Detects the execution of AdvancedRun utility
Detects suspicious command lines used in Covenant luanchers
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Detects suspicious command lines used in Covenant luanchers
The following analytic detects the usage of headless browsers within an organization. It identifies processes containing the "--headless" and "--disable-gpu" command line arguments, which are indicative of headless browsing. This detection leverages data from the Endpoint.Processes datamodel to identify such processes. Monitoring headless browser usage is significant as these tools can be exploited by adversaries for malicious activities like web scraping, automated testing, and undetected web interactions. If confirmed malicious, this activity could lead to unauthorized data extraction, automated attacks, or other covert operations on web applications.
The analytic detects the unusual invocation of the Windows Console Host process (conhost.exe) with the undocumented `--headless` parameter. This activity is significant for a SOC as it is not commonly used in legitimate operations and may indicate an attacker's attempt to execute commands stealthily. If confirmed malicious, this behavior could lead to persistence, lateral movement, or other malicious activities, potentially resulting in data exfiltration or system compromise.
This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.
Detects the execution of the AdvancedRun utility, which can be used to launch applications with different user permissions, including SYSTEM, or with modified environment variables. This utility is often used for legitimate administrative tasks but can also be leveraged by adversaries for privilege escalation or defense evasion, particularly by running processes with hidden windows.
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.
This rule detects PowerShell script execution where the 'WindowStyle Hidden' option is used. Adversaries often use this technique to conceal malicious activity from users by preventing the PowerShell window from being visible. The rule specifically looks for the combination of 'powershell', 'WindowStyle', and 'Hidden' within the script block text. A filter is applied to exclude legitimate Amazon WorkSpaces configuration scripts that use this option.
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
Page 5 of 5