Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where Windows Terminal (WindowsTerminal.exe) is launched by Explorer and immediately spawns a shell process (PowerShell, PWSH, or CMD), specifically excluding devices that have recorded recent RunMRU registry history. This pattern may indicate suspicious or non-interactive execution by an adversary attempting to bypass traditional shell history tracking.
Detects the use of nodejs.exe to initiate external network tunnels to known tunneling services like pinggy.io or generic tunnels using common tunnel configuration flags.
Detects access, retrieval, or modification of the 'RegisteredOrganization' registry value under 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'. This key often contains information about the registered owner or organization of the Windows installation and is frequently queried or modified during reconnaissance or environment configuration.
Detects instances where a process named 'updater.exe' launches another process also named 'updater.exe'. This pattern can indicate suspicious activity where a legitimate updater process is being misused or abused to spawn additional malicious code or side-load components.
This rule monitors for PowerShell commands that combine common data collection flags ('-Recurse', 'Documents') with 'Invoke-WebRequest' to perform a POST method upload. This pattern is commonly associated with the staging and exfiltration of sensitive files from local directories to a remote destination via HTTP/S.
Detects the execution of the Windows binary InstallUtil.exe using specific flags (/logfile=, /LogToConsole=false, and /U) commonly used to execute arbitrary .NET code while bypassing application control mechanisms such as AppLocker or Windows Defender Application Control (WDAC).
Detects the execution of regsvr32.exe with flags indicative of the Squiblydoo technique, which utilizes the /i parameter to load a remote COM scriptlet (.sct file) via scrobj.dll. This method is a known application allowlisting bypass technique.
Detects the execution of odbcconf.exe with the REGSVR action. This technique leverages the legitimate Windows utility odbcconf.exe to load and execute arbitrary DLLs, bypassing security controls that might not monitor or restrict this binary.
This rule detects the execution of suspicious shortcut (.lnk) files or the use of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) to initiate processes related to specific, potentially malicious filenames often associated with phishing or social engineering campaigns. The rule monitors for these activities occurring in user-writable directories such as Downloads, Desktop, or Temp.
Detects the execution of cmstp.exe with silent (/s) and auto-install (/au) flags pointing to an attacker-supplied INF file. This pattern is a documented technique for bypassing User Account Control (UAC) and performing signed-binary proxy execution to load malicious payloads.
Detects the use of command-line utilities (cmd.exe, curl.exe, tar.exe) to download or interact with specific suspicious zip archives (python-3.10.0-embed-amd64.zip, temp012.zip, MusicLibrariesPackage) from known staging directories or external sources often associated with malicious staging or persistence.
Detects the execution of Control Panel (.cpl) files via control.exe from non-standard system directories, or the use of rundll32.exe to invoke CPL applets. These methods are commonly used to proxy malicious code execution while appearing legitimate.
Detects the abuse of the legitimate Windows script 'SyncAppvPublishingServer.vbs' to proxy the execution of malicious commands, specifically by appending an arbitrary command separated by a semicolon.
Detects the execution of the Program Compatibility Assistant (pcalua.exe) with the '-a' flag to launch executables located in common user-writable directories such as Temp, Downloads, or AppData. This behavior is a known Living off the Land Binaries and Scripts (LOLBAS) technique used to proxy execution and potentially bypass security controls or break parent-child process lineage.
Detects the use of command-line utilities (cmd.exe, curl.exe, tar.exe) to download or interact with specific suspicious zip archives (python-3.10.0-embed-amd64.zip, temp012.zip, MusicLibrariesPackage) from known staging directories or external sources often associated with malicious staging or persistence.
Detects the execution of wscript.exe or cscript.exe with VBScript or JScript files from user-writable and temporary directories, such as %TEMP%, %APPDATA%, and Downloads folders. This pattern is commonly associated with the execution of malicious droppers and loaders in malspam campaigns.
Detects the execution of cmd.exe with suspicious command-line obfuscation patterns. The rule looks for the use of the '/k' flag combined with variable assignment and character substitution/expansion patterns (e.g., %var:~start,len%), often used in batch file obfuscation to execute malicious logic. It specifically triggers when originating from common suspicious parents like explorer.exe or Bandizip.exe, or when targeting syswow64 locations.
This rule detects potentially malicious command execution initiated by or linked to the Bandizip archive utility. It identifies scenarios where Bandizip launches shells (cmd, powershell, wscript, cscript) to execute scripts or commands (e.g., .lnk files, .bat, .vbs, .js, .ps1), or where suspicious 'cmd.exe /k' commands are executed directly or through an updater process.
Detects the use of odbcconf.exe with the REGSVR flag to load DLLs from suspicious directory locations (such as Temp, Downloads, or AppData), a technique used by adversaries to proxy execution and bypass application control.
Detects the execution of installutil.exe with specific command-line arguments (logging disabled, uninstall flag) from file paths outside of the standard .NET directory structure. This pattern is commonly used by attackers to proxy execution of arbitrary managed code, effectively bypassing application whitelisting and security controls.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Page 309 of 1908