Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects command-line activities indicative of the uninstallation of Raccine, a ransomware protection tool. It specifically looks for combinations of commands used to terminate Raccine processes, delete its registry entries, and remove its scheduled tasks. The detection logic covers `taskkill` commands targeting `RaccineSettings.exe`, `reg.exe delete` commands referencing "Raccine Tray", and `schtasks /DELETE` commands for "Raccine Rules Updater".
This rule detects executable files created in the Downloads folder that lack common file metadata fields such as FileVersion, Description, Product, or Company. This characteristic is often observed in executables generated by tools like py2exe, which can be used by adversaries to package Python scripts into standalone executables, potentially for malicious purposes. The rule specifically looks for the absence of these fields (indicated by a '?' in the rule logic) in conjunction with the file being located in a user's Downloads directory.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Detects the execution of the LOLBIN (Living Off the Land Binaries and Scripts) `gpscript.exe` when it is used to execute logon or startup scripts configured in Group Policy. This rule specifically looks for `gpscript.exe` being executed with the `/logon` or `/startup` command-line arguments, while filtering out legitimate executions where `gpscript.exe` is parented by `svchost.exe` with the `gpsvc` service.
Detects the use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file when ie4uinit.exe is not run from its usual system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). This behavior is indicative of an adversary attempting to bypass defenses by proxying execution with a trusted system binary.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process". This technique can be used to bypass application control and execute malicious code.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
Page 305 of 319