Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of rundll32.exe or regsvr32.exe where the command line arguments reference a DLL that was recently written to the disk on the same host. This behavior is indicative of a RAT or malware dropping a secondary payload (DLL) and immediately executing it using built-in Windows binary proxies to bypass security controls.
Detects the 'ClickFix' social engineering pattern where an adversary tricks a user into using the Windows Run dialog (explorer.exe) to execute msiexec.exe, downloading and installing a remote MSI package. This is frequently associated with malware delivery, such as Psychedelic Stealer, where users are prompted to copy and paste malicious commands under the guise of fake error messages or CAPTCHAs.
Detects the execution of PowerShell commands that reflectively load .NET assemblies into memory, followed immediately by a process injection event targeting Chromium-based browsers (e.g., chrome.exe) or Firefox. This behavior is highly characteristic of credential harvesting tools like BoundSiphon, which injects code into browser processes to decrypt and extract App-Bound encryption keys.
This rule detects suspicious PowerShell command-line activity that uses '-ExecutionPolicy Bypass' in conjunction with network-fetching cmdlets like 'Invoke-RestMethod' or 'irm' to download files to a temporary directory, followed by potential script execution. This pattern is commonly used by adversaries for stage-1 payload delivery and fileless execution.
Detects msiexec.exe initiating network connections to or executing packages from endpoints containing 'capher.php' and token parameters. This behavior is associated with the 'ClickFix' delivery chain, where adversaries use malicious websites or scripts to trick users into downloading and executing installer files.
Detects the execution of the DEL command via cmd.exe spawned by sqlservr.exe, specifically targeting batch scripts, executables, or text files located within AppData or ServiceProfiles paths. This behavior is indicative of post-exploitation activity where an attacker removes staging artifacts used during lateral movement or persistence phases to hide their tracks after using xp_cmdshell.
Detects the execution of binaries using the '-i -c <batch_file>' command-line argument pattern, which is characteristic of the NetworkServiceExploit tool used for token impersonation and privilege escalation. This rule specifically monitors for this pattern when spawned by processes like sqlservr.exe, commonly seen in exploitation chains involving xp_cmdshell.
Detects post-compromise activity associated with the NeedyMantis group, specifically the staging of a legitimate binary alongside a malicious DLL and a paired archive, followed by the execution of the legitimate binary to trigger DLL side-loading. This activity is typically preceded by Impacket-style remote command execution (e.g., wmiexec, smbexec, atexec).
Detects the execution of a specific, tampered version (12.5.1) of the DAEMON Tools Lite installer, which has been identified as a distribution vector for malicious activity linked to Storm-3069.
Detects instances where an unexpected process loads both 'amsi.dll' and .NET runtime modules ('clr.dll' or 'mscoree.dll'). This behavior is frequently associated with malicious, position-independent shellcode that attempts to disable AMSI scanning and host the CLR in-memory to execute malicious .NET assemblies or payloads, avoiding standard .NET execution environments like PowerShell or msbuild.exe.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
Detects suspicious command execution patterns (such as PowerShell encoded commands, IEX, or cmd.exe) being stored or accessed within the Windows Registry 'TypedPaths' key, which is used by Windows Explorer to track recently accessed paths. Adversaries may attempt to use this location to execute payloads via user-triggered interactions.
Detects a suspicious command-line chain where 'cmdkey' is used to add credentials, followed by the execution of 'regsvr32' targeting a DLL file hosted on a remote UNC path. This pattern is commonly associated with ClickFix or FileFix techniques where an adversary attempts to force authentication and execute malicious code via proxy execution.
Detects instances where Windows Explorer launches command interpreters (cmd.exe, powershell.exe, wscript.exe, or mshta.exe) with suspicious leading whitespace in the command-line arguments. This behavior is often associated with obfuscation techniques intended to bypass command-line monitoring or security filters.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task configuration is fetched from a remote XML file (HTTP/HTTPS URL). This pattern is often used by adversaries to download and execute malicious payloads via task scheduling, bypassing local file restrictions.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.
This rule detects non-browser processes that simultaneously access a web browser's 'Local State' file and the Windows DPAPI master key storage directory. This behavior is a common precursor to credential dumping, as adversaries must decrypt browser-protected secrets (passwords and cookies) using DPAPI keys stored in the user's profile.
Detects instances where a Claude process accesses a 'SKILL.md' file, followed closely by a suspicious command execution on the same device. The rule specifically targets command-line activity that involves encoding, download-and-execute patterns, staging in sensitive directories, or communication with suspicious domains/IPs, which is indicative of a supply-chain or poisoned agent-skill file attack.
Detects a single process reading browser cookie SQLite database files across multiple distinct browser profile directories or different web browsers within a short time window. This behavior is indicative of infostealer activity attempting to harvest session cookies for session hijacking and MFA bypass.
Detects a suspected infostealer activity chain involving the unauthorized access of credential and session cookie files, followed by the archival of these files into a temporary or staging directory, and concluding with an outbound network connection to an uncommon destination from the archiving process.
Page 28 of 465