Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,660
9,755
6,689
4,418
3,748
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects the use of the PowerShell cmdlet 'Get-DnsServerResourceRecord' to enumerate DNS zone records. Attackers frequently use this technique to map out network infrastructure, identify internal assets, and discover target subnets within an Active Directory environment.
Detects instances where FortiTray.exe or scheduler.exe (associated with FortiClient) initiate a cmd.exe process that subsequently launches a PowerShell process with hidden window (-w 1) and encoded command (-enc) flags. This pattern is indicative of a living-off-the-land attack where a legitimate, signed application process is abused to execute obfuscated malicious payloads.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
This rule detects attempts to enumerate Active Directory domain trust relationships using common administrative tools. It identifies the execution of 'nltest.exe' with trust-related arguments ('/domain_trusts', '/trusted_domains', '/all_trusts', '/dclist:') and the usage of PowerShell cmdlets or commands ('Get-ADTrust', 'netdom query trust', or Active Directory domain queries) known for querying domain trust configurations. Adversaries often perform this discovery to map out Windows multi-domain or forest environments to identify lateral movement opportunities.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell Cmdlets, or WMI providers. These actions are common techniques for attackers to impair system defenses and remove evidence of their activities from a compromised host.
This rule detects attempts to enumerate Active Directory domain trust relationships using common administrative tools. It identifies the execution of 'nltest.exe' with trust-related arguments ('/domain_trusts', '/trusted_domains', '/all_trusts', '/dclist:') and the usage of PowerShell cmdlets or commands ('Get-ADTrust', 'netdom query trust', or Active Directory domain queries) known for querying domain trust configurations. Adversaries often perform this discovery to map out Windows multi-domain or forest environments to identify lateral movement opportunities.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects various methods of anti-forensics activity commonly used to hide attacker presence, including clearing Windows Event Logs via wevtutil or PowerShell, deleting the USN Journal via fsutil, and bulk file deletion using command-line utilities.
This rule detects the creation of scheduled tasks using either schtasks.exe or PowerShell (Register-ScheduledTask) that exhibit high-risk indicators. These indicators include executing files from suspicious locations (AppData, Temp, or specific user-writable directories), the use of encoded PowerShell commands, or initiation by common remote access tools (sshd, ssh, or mstsc). This behavior is often associated with persistence mechanisms used by adversaries.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
This rule detects potential Akira ransomware activity by correlating three distinct malicious phases on a network: first, the deletion of volume shadow copies using vssadmin, wmic, or powershell; second, the disabling of system recovery features via bcdedit or wbadmin; and third, high-volume file renaming (indicating encryption) across multiple endpoints. The rule aggregates these events to identify coordinated campaign activity across at least two hosts.
This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.
Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.
Page 3 of 24