Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects execution of common Windows network configuration utilities (ipconfig, arp, route) by known command-line and script interpreters. This pattern is indicative of an attacker performing reconnaissance to gather information about the host's network settings, interfaces, and connectivity.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the use of regsvr32.exe with the /s (silent), /u (unregister), and /i (install) flags to execute a remote COM scriptlet (SCT) via an HTTP or HTTPS URL. This is a known technique (often referred to as Squiblydoo) to bypass application control by leveraging a trusted, signed Windows binary to download and execute code from a remote server.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
This rule detects the use of native Windows utilities such as nltest.exe, netdom.exe, and PowerShell to enumerate Active Directory domain trust relationships. Attackers commonly perform this discovery to map out target environments, identify lateral movement opportunities, or plan further exploitation in multi-domain or forest environments.
This rule detects potential Active Directory enumeration attempts by monitoring for the execution of common command-line tools and PowerShell cmdlets used to query domain information, such as users, groups, and domain controllers.
Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Detects potential persistence mechanisms associated with SharkLoader or similar malware campaigns. The rule monitors for unauthorized modification of Windows Run registry keys by non-Microsoft signed processes, the creation of suspicious scheduled tasks masquerading as legitimate update tasks (e.g., OneDrive or Microsoft updates), and the execution of processes from common malware working directories like 'AppData/Roaming/xwreg' or 'AppData/Roaming/xgdf'.
Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.
Detects the creation of a scheduled task named 'RageGuard' or containing 'RageGuard' in its command line, often associated with TrymeLocker malware. The rule monitors for Task Scheduler Event IDs 4698 and 106, as well as schtasks process command line arguments used to create such tasks.
Detects the addition of a persistence mechanism by writing a registry value named 'browser' to the Windows Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). The rule specifically looks for registry string values pointing to executables located within the user's AppData\Local directory, which is a common technique for establishing user-level persistence via masquerading as a web browser.
Detects the use of legitimate Windows utilities 'timeout.exe' and 'ping.exe' to introduce delays in command execution. This behavior is often associated with malware or malicious scripts attempting to evade sandboxes or time-based security analysis.
Detects the Pay2Key ransomware dropper's attempt to obfuscate its presence by using 'fsutil setZeroData' to wipe its own binary content followed by the deletion of associated executable and batch cleanup scripts to hinder forensic investigation.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Page 25 of 29