Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects the execution of SyncAppvPublishingServer.vbs via wscript.exe or cscript.exe. This legitimate Windows script can be abused by adversaries to proxy execution of malicious PowerShell commands, bypassing execution restrictions and evading defensive measures.
KQL Query from file: INC Ransomware Command Execution
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Detects execution of OneDriveUpdater.exe from C:\ProgramData, which may represent a masqueraded binary attempting to impersonate legitimate Microsoft software. This could indicate an attempt at defense evasion or persistence by an attacker.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
LOLBAS shell32
S1QL
This rule detects the execution of `rundll32.exe` with `shell32.dll` that subsequently launches `cmd.exe`. This behavior is often associated with adversaries using `rundll32.exe` as a proxy to execute commands, specifically leveraging `shell32.dll` to invoke `cmd.exe`. The rule includes several exclusions to reduce false positives, such as legitimate `msiexec.exe` parent processes, specific `RunDLL` commands, and `autorun.bat` related activities.
Detects the execution of rundll32.exe with command-line arguments indicative of running an HTML Application (mshtml,RunHTMLApplication) or directly executing JavaScript. This technique is often used by adversaries for code execution and bypassing security controls.
Page 308 of 864