Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
Detects the execution of rundll32.exe initiated by explorer.exe where the command line references common user folders (AppData, Temp, Downloads) and includes suspicious file extensions (e.g., images, PDFs, Office docs). This pattern is often indicative of malicious code execution where an adversary uses rundll32.exe to proxy execution of payloads masked as benign files.
Detects SystemSettings.exe running from user-writable AppData or ProgramData directories, or SystemSettings.dll being loaded by SystemSettings.exe from these locations. This behavior is indicative of SharkLoader DLL sideloading, often used as a first stage in attacks.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
This rule detects cross-process operations (such as memory access or thread injection) initiated by processes that are not signed by known, trusted vendors, or that do not reside in protected system directories. This behavior is a common indicator of process injection techniques used to evade security controls.
Detects the execution of known critical system processes (e.g., svchost.exe, lsass.exe) from directories other than the standard Windows System32 or SysWOW64 paths. This behavior is indicative of masquerading, where an adversary attempts to evade detection by naming malicious files after legitimate system binaries.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
This rule detects the execution of PowerShell or pwsh.exe with an encoded command. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for the '-EncodedCommand' or '-enc' parameter followed by a base64-encoded string of at least 20 characters.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects the execution of mavinject.exe with the /INJECTRUNNING command-line argument. This utility is a signed Microsoft binary that can be abused by adversaries to inject arbitrary DLLs into the address space of running processes, a technique often used to evade detection or achieve code execution.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects the execution of mshta.exe with arguments containing URLs, script languages (vbscript, javascript), or .hta file extensions, which is a common technique used by attackers to execute malicious code via a legitimate Windows utility.
Detects usage of the Regsvr32.exe utility to load and execute remote scriptlets from an external HTTP source. This technique, often referred to as Squiblydoo, allows adversaries to bypass application control by leveraging a trusted, signed Windows binary to proxy the execution of malicious code without registering it in the registry.
Page 332 of 864