Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
Detects execution of cmd.exe with suspicious command-line patterns utilizing environment variable substring expansion (%VAR:~offset,length%). This technique is used to dynamically reconstruct and execute obfuscated commands, a method historically observed in APT37 delivery chains to hide malicious payloads and bypass simple string-based signatures.
Detects the execution of WinGet DSC backend services, ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, when launched as child processes of WinGet or DSCourier. This behavior is indicative of potential proxy execution abuse where WinGet components are leveraged to execute arbitrary code or configurations via signed Microsoft binaries.
This rule detects malicious .lnk files typically delivered as email attachments (spearphishing). It identifies shortcuts that execute cmd.exe with the /k switch, combined with environment variable substring expansion techniques designed to obfuscate multi-stage command execution chains.
Detects the execution of PowerShell scripts located in Windows temporary directories (AppData/Local/Temp or Temp) that utilize common evasion flags such as hidden window style, bypass execution policy, or non-interactive mode. This behavior is frequently associated with initial stagers, droppers, or malicious script execution.
Detects HTTP POST requests to a known suspicious endpoint ('/board.php') often used by the Chinotto Python backdoor. The rule monitors for outgoing web traffic containing 'data=' parameters or connections to known malicious domains, indicating potential exfiltration of base64-encoded command output.
Detects the execution of 'winget.exe' with the 'configure' command. This command is used to apply configuration files (typically YAML-based) to the system, which can automate software deployment, environment setup, or system changes. Adversaries may abuse this utility to facilitate malicious software deployment or system configuration changes via legitimate administrative tools.
Detects the execution of Windows Package Manager and configuration-related server binaries (WindowsPackageManagerServer.exe, ConfigurationRemotingServer.exe, DSCourier.exe) when not initiated by the authorized 'winget.exe' process. The rule further correlates these processes with the absence or delayed loading of the 'Microsoft.Management.Configuration' library, which may indicate unauthorized usage or tampering with package/configuration management components.
Detects the execution of the Windows ftp.exe binary using the -s parameter (or -s"": syntax) to execute a script file. This behavior is commonly associated with attackers using LOLBAS (Living Off the Land Binaries and Scripts) techniques to execute hidden or obfuscated scripts from mounted virtual hard disks (VHD) to facilitate malicious backdoor execution.
Detects suspicious command-line strings stored in the Windows Explorer RunMRU registry key. Adversaries may use this location to store persistence commands or to obfuscate command-line arguments that are intended to be executed by the user or via automated processes.
Detects unauthorized access to VPN configuration files associated with common VPN providers (CyberGhost, NordVPN, ExpressVPN). This behavior is characteristic of the Hannibal Stealer, which attempts to exfiltrate these files to compromise user VPN sessions and credentials. The rule filters out legitimate process access to minimize false positives.
This rule detects the execution of common command-line or scripting tools (cmd.exe, powershell.exe, wscript.exe, cscript.exe, ftp.exe) or .lnk file handling triggered by explorer.exe immediately following the mounting of a VHD or VHDX file. This behavior is indicative of an attacker mounting a malicious virtual disk image and executing payloads contained within it.
This rule detects three distinct suspicious behaviors related to potential file manipulation and persistence mechanisms: 1. Use of 'copy /b' command to reconstruct files from fragments (e.g., header.doc, body.doc), commonly associated with file joining or data reconstruction. 2. File access within '_rels' directories targeting document fragments, often used in malicious document analysis or extraction. 3. Execution of 'Windowsupdate.exe' from the 'AppData\Local' directory, a technique often used for masquerading as a legitimate Windows service to establish persistence.
This rule detects thread creation activities where the thread start address is spoofed to point to 'user32.dll!AnimateWindow'. This behavior is a technique used by the MinHook library (specifically in SparroWocky-style implementations) to conceal the true entry point of a thread and evade detection during process injection or thread hijacking.
Detects reflective or beacon-style in-memory process injection where an injection-type action occurs in a target process, but no corresponding file creation event is recorded by the initiating process. This behavior is indicative of fileless malware loaders or reflective COFF-based execution, commonly used in adversary techniques like BOF (Beacon Object File) execution to bypass static disk-based security controls.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects the execution of 'gitlab-runner.exe' with command-line arguments indicative of runner registration, configuration file interaction, or process execution. This activity may be indicative of legitimate CI/CD pipeline setup or potential persistence mechanism installation if performed by unauthorized accounts.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects the use of PowerShell to download a file named Document.pdf using Invoke-WebRequest, saving it to disk, and immediately executing it using Start-Process. This behavior is indicative of a dropper or secondary stage payload execution pattern.
Page 184 of 1908