Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
Detects reconnaissance behavior associated with the KuinaExtractor tool, identified by three or more distinct WMI hardware-related queries (CPU, disk, memory, etc.) executed within a 5-minute window by a non-administrative parent process.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
Detects the use of regsvr32.exe with the /s (silent), /u (unregister), and /i (install) flags to execute a remote COM scriptlet (SCT) via an HTTP or HTTPS URL. This is a known technique (often referred to as Squiblydoo) to bypass application control by leveraging a trusted, signed Windows binary to download and execute code from a remote server.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
Detects reconnaissance activity targeting Active Directory group structures and membership, utilizing common administrative tools such as net.exe, PowerShell, and dsquery. This rule identifies patterns associated with domain group discovery and identification of privileged accounts.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Detects the use of WScript or CScript (Windows scripting engines) to launch commands intended to disable or tamper with security products, including Windows Defender, system firewalls, Bitdefender, and Kaspersky antivirus solutions.
Detects behavior patterns associated with the LCRYX ransomware, specifically lateral movement via WMI (wmic.exe), network subnet scanning, file copy operations to remote SMB shares, and the dropping or execution of VBScript artifacts on removable or non-system drives.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
Detects the execution of mshta.exe when invoked with command-line arguments indicative of script execution (e.g., vbscript:, javascript:, http(s)://) or when spawned by common Microsoft Office applications. This behavior is frequently associated with malicious document-based attacks, where office macros trigger mshta to download or execute obfuscated code.
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for modifications to specific registry keys (ms-settings\Shell\Open\command) followed by the execution of known auto-elevating Windows binaries like 'fodhelper.exe' or 'computerdefaults.exe'. The rule correlates the registry modification with a subsequent process creation from an suspicious location, indicating a likely attempt to gain elevated privileges.
Detects instances where known Windows binaries frequently abused for User Account Control (UAC) bypass (fodhelper.exe, eventvwr.exe) spawn unexpected child processes. These binaries are trusted system utilities that, when used as an actor for launching other processes, often indicate malicious activity aimed at privilege escalation.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, wbadmin, diskshadow) and PowerShell to delete Volume Shadow Copies or disable system recovery features. These activities are commonly used by ransomware to prevent easy restoration of encrypted data.
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
Detects the execution of Python interpreters from non-standard or typically user-writable locations (e.g., AppData, Temp, Downloads) or when the command line includes execution of a script file. This rule excludes common development environments to reduce noise, focusing on potentially malicious usage of Python for persistence or execution of staged scripts.
Page 22 of 29