Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects execution of the Microsoft InstallUtil.exe utility with suspicious command-line arguments (logging suppressed to file and console) where the binary is unsigned. This is a common technique used by adversaries to proxy execution of arbitrary .NET code while attempting to avoid detection and maintain stealth.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.
Detects the W2 Malvertising loader waiting for the EDR to be killed before performing cross-process injection (Process Hollowing) into a new legitimate binary. This rule correlates the loading of a new, non-Windows driver with subsequent process memory injection within a 5-minute window, indicating potential BYOVD (Bring Your Own Vulnerable Driver) attacks followed by in-memory malware execution.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Detects the execution of rundll32.exe initiated by explorer.exe where the command line references common user folders (AppData, Temp, Downloads) and includes suspicious file extensions (e.g., images, PDFs, Office docs). This pattern is often indicative of malicious code execution where an adversary uses rundll32.exe to proxy execution of payloads masked as benign files.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
Page 331 of 864