Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where a process spawns a child process using the exact same executable image path, specifically when the executable is located in user-writable directories such as Downloads or AppData\Local\Temp. This behavior is a common indicator of process hollowing or self-injection techniques used by malware, such as loaders that decrypt payloads in memory and then spawn a new, hollowed instance of themselves to execute the malicious code, frequently observed during post-exploitation activities.
Detects the presence of a specific malicious _socket.pyd Python module associated with LegionLoader dropped into non-standard directories like 'Traiolx Custom Utils'. The detection leverages file path patterns and known file hashes of the malicious component.
Detects a suspicious process pattern where an executable running from a staging directory (Temp or Downloads) spawns a child process of itself, followed by a registry modification performed by that child process. This behavior is indicative of malicious loaders, such as OnyxC2, that sideload components and establish runtime configurations before C2 communication.
Detects the execution of wmic.exe when launched by uncommon parent processes, specifically mshta.exe or wscript.exe. These parent processes are often associated with the execution of malicious scripts (e.g., .hta or .vbs files), which may use wmic.exe for system discovery or execution of commands, a common pattern in file-based living-off-the-land attacks.
Detects modifications to Windows Registry Run keys that execute PowerShell scripts named 'Update.ps1' with hidden window and bypass execution policy flags. This pattern is consistent with Lightlife RAT persistence mechanisms.
Detects the execution of wscript.exe as a child process of mshta.exe, specifically when the wscript.exe command line contains references to .vbs or .js files. This behavioral pattern is often associated with malicious HTA files using mshta.exe as a proxy to execute secondary script payloads, a technique commonly leveraged for initial access and execution.
Detects modifications to the Windows Registry designed to disable PowerShell ScriptBlockLogging. This is a common defense evasion technique used by attackers to hide malicious PowerShell commands and scripts from security monitoring.
Detects the creation or modification of Windows Registry Run/RunOnce keys that reference msbuild.exe without typical build arguments. This is often used by adversaries to maintain persistence by executing malicious XML-based projects or inline C#/VB code via a trusted system utility.
Detects the use of PowerShell to download the gitlab-runner-windows-amd64.exe binary from the official AWS S3 distribution bucket. This behavior is indicative of an attacker attempting to stage the GitLab Runner service to establish command and control or persistence within a compromised Windows environment.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) directly spawned by a GitLab Runner process. This behavior is associated with the abuse of GitLab CI/CD runners as a Command and Control (C2) mechanism to execute unauthorized commands on build infrastructure.
Detects the modification of the registry value 'EnableScriptBlockLogging' to '0' (Disabled) under the PowerShell policy path. This action suppresses the generation of Windows Event ID 4104 (PowerShell Script Block Logging), which is a critical source for monitoring attacker-issued PowerShell commands and detecting post-exploitation activity.
Detects the creation or execution of a scheduled task masquerading as a Microsoft Update process. The task is configured to execute potentially malicious components, specifically identified by filenames such as userscreen.exe, UserInerfacePicture, or config.cat. This behavior is indicative of persistence and execution of malicious payloads, as seen in campaigns involving the NarwhalRAT loader.
Detects anomalous GitLab CI pipeline execution that matches patterns associated with GitRunner C2 abuse. The detection identifies pipelines triggered via API (CI_PIPELINE_SOURCE=api) with cloning disabled (GIT_STRATEGY=none) and a specific static job name (run_command), which can indicate the CI runner is being abused as a command-and-control channel for arbitrary script execution.
Detects cmd.exe processes utilizing variable assignment and dynamic substring expansion to reconstruct and execute obfuscated PowerShell commands, a technique frequently observed in malicious LNK file decoy campaigns to evade static signature detection.
Detects unsigned or non-standard Python processes loading core Windows system modules like kernel32.dll or ntdll.dll. This behavior is consistent with NarwhalRAT's fileless execution technique, which utilizes ctypes to interact with low-level Windows APIs (VirtualAlloc, RtlMoveMemory, CFUNCTYPE) for in-memory payload allocation and execution, bypassing traditional disk-based detection.
Detects the execution of PowerShell scripts containing a combination of Base64 encoding, compression (Deflate/Gzip), and UTF-32 decoding. This specific layering is commonly used to obfuscate malicious payloads and evade signature-based detection mechanisms in PowerShell environments.
This rule detects the execution of LNK or HTA files from a WebDAV share (DavWWWRoot) using common Windows binaries like mshta.exe, wscript.exe, cscript.exe, or explorer.exe. This pattern is commonly associated with the 'ClickFix' technique, where users are lured into opening malicious files hosted on remote WebDAV shares to achieve code execution.
Detects the presence or execution of the 'Boot Time Removal Tool' (BTR.sys) driver when it originates from locations outside of the legitimate Windows Defender platform or is initiated by processes not associated with the Defender ecosystem. This behavior is indicative of potential BYOVD (Bring Your Own Vulnerable Driver) attacks where attackers deploy known vulnerable drivers to gain kernel-mode privileges or interfere with security software.
This rule detects PowerShell script blocks containing a suspicious combination of Base64-like character sets and Cyrillic characters. This technique is often used in obfuscated payloads to evade static analysis signatures or to hinder human readability by inserting non-Latin characters within encoded content, which may trigger different parsing behaviors in various environments.
Detects the use of legitimate Windows binaries (Rundll32, Wscript, Cscript, and Regsvr32) to execute scripts, HTML applications, or remote scriptlets. This pattern is commonly associated with adversary techniques to proxy execution of malicious code, bypass application controls, or retrieve payloads from remote servers.
Detects the execution of Windows Terminal, PowerShell, or pwsh processes spawned directly by explorer.exe that do not originate from standard Start Menu search or navigation host processes. This pattern is indicative of the user triggering the 'Power User' (Win+X) menu, often associated with adversary attempts to leverage ClickFix-style social engineering lures that rely on the user interacting with specific UI elements.
Page 207 of 1908