Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of PowerShell with encoded commands originating from scripting engines wscript.exe or cscript.exe. The command line contains indicators of malicious activity such as references to external domains, archive expansion, or specific executable payloads.
Detects the Microsoft Edge browser executable running from an anomalous path (C:\ProgramData\Microsoft\Windows\Telemetry\) or exhibiting suspicious network behavior (to a known malicious domain 'deadhub.org' or IP address '193.23.118.155'). This behavior is indicative of a masquerading attempt to hide malicious activity by mimicking a trusted browser binary.
Detects modifications to HKEY_CURRENT_USER Run keys associated with the HEAVYGRAM backdoor, which uses specific filenames and patterns to establish persistence via autorun registry entries.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
This rule detects potentially malicious activity where specific non-standard processes (e.g., RuntimeSSH.exe, MicDriver.exe, MsCache.exe) either execute PowerShell commands related to security feature tampering (disabling Windows Defender exclusions) or create persistent Registry run keys associated with these process names. This pattern is indicative of malware attempting to establish persistence or evade security controls.
Detects the creation of a scheduled task named 'OneDrive KeepAlive' or a task set to execute every 5 minutes, in conjunction with the execution of 'taskhostw.exe' containing 'exec hide' in its command line. This pattern is indicative of the Kimsuky threat group using a renamed version of the NirCmd utility to maintain persistence and execute commands silently.
Detects the suspicious copying of the Windows certutil.exe binary to an alternate location (e.g., /Users/Public/Downloads/) followed by execution with decoding or caching flags. This behavior is indicative of an adversary attempting to use certutil as a LOLBin to decode or reassemble malicious payloads, a tactic frequently observed in Kimsuky-related LNK malware campaigns.
Detects PowerShell command execution containing specific strings associated with the Veil framework XOR decoding routine, including a hardcoded key and the use of the -bxor operator for payload deobfuscation.
Detects instances where WScript.exe or CScript.exe spawn PowerShell.exe as a child process. The rule specifically looks for command-line arguments indicative of policy bypass (-ExecutionPolicy Bypass) and remote payload retrieval (Invoke-WebRequest, DownloadString), which is a common pattern in obfuscated JavaScript-based infection chains.
Detects the use of .NET reflection APIs (specifically System.Reflection.Assembly::Load) within PowerShell script blocks. This technique allows for the dynamic loading of .NET assemblies into memory, often to execute obfuscated or encrypted payloads without writing them to disk, which is a common tactic for bypassing file-based security controls.
Detects the use of PowerShell Stop-Process being used to terminate common scripting and .NET-related processes, a behavior associated with the Veil#Drop loader to clear potential conflicts or interference from legitimate host processes.
Detects the execution of Microsoft-signed .NET utilities (RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, AspNet_Compiler) when spawned by scripting engines like PowerShell, wscript, or cscript. This behavior is indicative of the Veil#Drop framework using trusted developer utilities as a fallback mechanism to execute secondary payloads or bypass security controls.
Detects the use of [ScriptBlock]::Create() within PowerShell command lines. This method allows for the dynamic construction and execution of arbitrary PowerShell code entirely in memory, a technique often used by fileless malware and frameworks like Veil#Drop to evade disk-based detection mechanisms.
Detects the potential creation or execution of malicious JavaScript files that masquerade as PDF or other common documents using double extensions (e.g., .pdf.js). This behavior is often associated with file-based loaders where the operating system masks the true file extension. The rule also triggers when these files are explicitly launched via Windows Script Host (wscript.exe or cscript.exe).
Detects PowerShell execution commands attempting to disable Antimalware Scan Interface (AMSI) by reflectively accessing System.Management.Automation.AmsiUtils. This is a common technique used by attackers to execute malicious scripts while avoiding detection by security software.
Detects the creation of .bat files within the Windows Startup folder. Adversaries often use this technique to achieve persistence by ensuring a script executes automatically upon user login.
Detects AutoIT executables running from a Temp directory that take an .ini file as a command-line argument. This pattern is commonly used by AutoIT-based malware loaders or droppers to ingest configuration files containing obfuscated code or C2 communication parameters.
Page 268 of 1908