Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,660
9,755
6,689
4,418
3,748
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Detects reconnaissance activity associated with Akira ransomware, including PowerShell-based share enumeration (Invoke-ShareFinder, Get-NetShare), execution of unauthorized network scanning tools (e.g., SoftPerfect NetScan from non-standard paths), and the use of 'net view /domain' commands to identify accessible network resources.
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from common public file sharing and code repository sites, which is a known technique for adversaries to stage or download malicious payloads.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate background data transfer jobs pointing to non-Microsoft or non-Windows Update domains. This technique is commonly used by adversaries for C2 communication or to download malicious payloads.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Detects reconnaissance activity targeting Active Directory group structures and membership, utilizing common administrative tools such as net.exe, PowerShell, and dsquery. This rule identifies patterns associated with domain group discovery and identification of privileged accounts.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from common public file sharing and code repository sites, which is a known technique for adversaries to stage or download malicious payloads.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects modifications to the WDigest UseLogonCredential registry value, which is a known technique to force Windows to store plaintext credentials in memory. This is often performed by adversaries using tools like Mimikatz to facilitate credential dumping from the LSASS process.
Page 4 of 24