Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of PowerShell or pwsh.exe with an encoded command. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for the '-EncodedCommand' or '-enc' parameter followed by a base64-encoded string of at least 20 characters.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.
Detects signs of access token manipulation and impersonation, including the use of 'runas' with saved credentials, suspicious PowerShell API calls for identity management, usage of known token-manipulation tools (e.g., incognito), and reconnaissance using 'whoami /priv'. These activities are indicative of privilege escalation attempts or lateral movement.
Detects potential credential dumping activities and unauthorized access to sensitive system files. The rule monitors for three primary indicators: raw disk device access (often associated with volume shadow copy dumping), suspicious DiskShadow utility execution, and NTDS.dit extraction using ntdsutil. Known administrative and backup software processes are excluded to minimize noise.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Identifies when a owner is was removed from a application or service principal in Azure.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.
Detects a PowerShell process initiated by node.exe that attempts to reflectively load a .NET assembly from memory. The detection specifically looks for keywords related to .NET Reflection, byte array loading, and a known C2 domain (hellolargeworld.com), along with the 'Extension.SubRoutine.Run2' invocation, indicating potential backdoor activity.
This rule detects attempts to disable PowerShell command history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle SaveNothing'. Adversaries often disable command history to evade detection and hinder forensic analysis.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.
This rule detects two primary indicators of potentially malicious activity involving the Windows Explorer process: 1) Suspicious process parentage, where explorer.exe is spawned by a parent other than the standard winlogon.exe, userinit.exe, or explorer.exe, or where explorer.exe spawns unusual child processes like cmd.exe, powershell.exe, or others. 2) Possible Parent PID (PPID) spoofing, identified by the presence of specific API-related keywords in the command line (e.g., SeImpersonatePrivilege, CreateProcessWithToken) within process creation events.
This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.
This rule detects PowerShell or pwsh processes executing commands that contain the string 'autogenstudio' combined with a base64-encoded or obfuscated command pattern. This behavior is indicative of an adversary attempting to execute obfuscated scripts or payloads associated with the Autogenstudio application or using it as a camouflage.
This rule detects potential malicious activity involving the 'wusvc.exe' executable. It flags instances where 'wusvc.exe' is executed from the user's Downloads folder or other non-standard paths, particularly when the file size is abnormally small (less than 100KB), which is indicative of masquerading or a dropper payload. The rule also checks for a known malicious file hash associated with the Snowlight dropper.
Page 314 of 864