Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects HTTP GET requests originating from internal hosts to external destinations where the User-Agent string contains 'AutoIt'. This behavior is indicative of the DarkGate malware downloading additional payloads or components using AutoIt scripting capabilities.
Detects the installation of a specific known malicious npm package named 'tw-pkgprobe-7731' via the command line, which may indicate a supply chain compromise or an attempt to execute malicious code within a development environment.
Detects DNS queries for the domain 'pdf.gusercontent.com', which is known to be used as a lookalike domain for Google-related services to deceive users. This pattern is often indicative of malicious infrastructure used for credential harvesting, phishing, or malware delivery.
Detects unauthorized outbound network traffic from browser processes to the lookalike domain 'pdf.gusercontent.com'. This domain is associated with a malicious Firefox browser extension, 'PDF Identity Verifier', which is designed to exfiltrate session telemetry and data from Google account sessions.
Detects the execution of command interpreters or scripting engines spawned by the ManageEngine ADSelfService Plus GINA client process (typically present at the Windows logon screen). This activity is highly suspicious as it indicates potential command injection or abuse of a pre-authentication component running at SYSTEM privileges.
Detects the execution of PowerShell scripts located in Windows temporary directories (AppData/Local/Temp or Temp) that utilize common evasion flags such as hidden window style, bypass execution policy, or non-interactive mode. This behavior is frequently associated with initial stagers, droppers, or malicious script execution.
Detects instances where wscript.exe spawns cscript.exe with a VBScript file in the command line. This sequence often indicates an attempt to run obfuscated or malicious scripts using built-in Windows scripting engines, which is a common technique for initial access or execution by adversaries.
This rule detects PowerShell commands that attempt to reassemble a Base64-encoded payload from multiple concatenated variable fragments. It specifically looks for patterns where filler characters ('*' or '?') are stripped from the payload before it is passed to the [Convert]::FromBase64String method. This technique is commonly used to evade static string analysis and signature-based detection.
Detects the execution of PowerShell (powershell.exe or powershell_ise.exe) initiated by Windows Script Host (wscript.exe or cscript.exe). The rule specifically looks for common obfuscation and stealth flags such as hidden window style, execution policy bypass, and non-interactive mode, which are often used by malicious scripts to execute code silently.
Detects the Windows Character Map utility (charmap.exe) loading suspicious modules such as amsi.dll or clr.dll followed by a process execution involving PowerShell or an unidentified command string, which is indicative of DLL side-loading or process hollowing techniques for malicious code execution.
Detects the execution of PowerShell with encoded commands that explicitly perform base64 string decoding using 'FromBase64String'. This pattern is frequently used to obfuscate scripts or payloads, often seen in downloader stagers or malicious scripts to bypass security controls.
Detects the installation of a new Windows service where the executable path is located in suspicious or uncommon directories (e.g., Temp, Users, AppData) or uses known living-off-the-land binaries (LotLBin) in the command path. This pattern is commonly used by adversaries for persistence and privilege escalation.
Detects execution of rundll32.exe from non-standard locations or utilizing specific exported DLL functions often associated with bypassing application whitelisting, executing scripts, or proxying malicious code execution.
This rule monitors for two potentially suspicious activities on Windows systems: the creation of scheduled tasks named 'MicrosoftEdgeUpdateTask' or 'MicrosoftEdgeUpdateTaskCore' using 'schtasks.exe', and the execution of scripts via 'wscript.exe' with silent flags ('//B' and '//Nologo'). These behaviors are often associated with persistence mechanisms or the execution of obfuscated/malicious scripts.
Detects the use of PowerShell to modify Windows Defender configuration settings, specifically targeting the disabling of real-time monitoring, behavioral monitoring, or other security protections via the Set-MpPreference cmdlet.
This rule detects potential usage of Hidden VNC (hVNC) tools by monitoring for specific command-line arguments (such as 'hvnc-input', 'hvnc-desktop', or 'HVNC_Telegram') and Windows events related to the creation or switching of desktops (e.g., 'CreateDesktop', 'SwitchDesktop'). hVNC is a common technique used by malware to establish a hidden remote desktop session for unauthorized access and control without alerting the user.
Detects usage of the Windows certutil.exe utility with flags commonly used by adversaries to download files from remote URLs or decode base64 encoded files. These techniques are often utilized for ingress tool transfer or deobfuscating malicious payloads.
Detects instances where a trusted, system-protected executable loads a DLL file from a user-writable or temporary directory that is not digitally signed or has an invalid signature. This is a common indicator of DLL side-loading or DLL hijacking, where an adversary attempts to execute malicious code by placing a malicious DLL in a location searched by a legitimate process.
Detects the use of the native Windows reg.exe utility to save the Security Account Manager (SAM) registry hive to a file. This technique is commonly used by adversaries to perform offline credential extraction or to dump local account password hashes.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning common LOLBAS (Living Off the Land Binaries and Scripts) child processes. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used to execute shell commands or scripts for payload delivery or execution.
Detects high-frequency failed RDP authentication attempts (Windows Event ID 4625 with LogonType 10) originating from the same source. This pattern is indicative of brute-force or credential guessing attacks against Remote Desktop Services.
Page 199 of 1908