Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
Detects instances where explorer.exe spawns command-line utilities (cmd.exe, powershell.exe, mshta.exe) with command-line arguments indicative of file downloading or remote execution (e.g., curl, certutil, bitsadmin, Invoke-WebRequest). This pattern is often associated with ClickFix social engineering attacks, where a victim is tricked into pasting malicious commands directly into the Windows Run dialog.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.
Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.
Page 21 of 29