Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
This rule detects the execution of 'mshta.exe' when its command line contains a URL pointing to a '.7z' archive. This behavior is suspicious as mshta.exe is often abused by adversaries to download and execute malicious content, and downloading an archive directly via mshta.exe is not a typical legitimate use case.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
Detects suspicious process activity originating from WSMProvHost, suggesting potential lateral movement or remote command execution
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
Detects RuntimeHost.exe launched from an unusual cache directory frequently associated with malware staging and cryptomining activity.
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
Detects browser processes launching PowerShell, CMD, MSHTA, or WScript. This behavior aligns with ClearFake-style social engineering campaigns that instruct users to copy and execute malicious commands.
Flags mutex creation (CPFATE) in .NET runtime, linked to Grixba ransomware scanner variants.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Identifies PowerShell executing scripts or expressions from the ProgramData directory, which may indicate malicious staging or backdoor execution. This rule specifically looks for PowerShell processes where the command line includes 'C:\ProgramData\' and also contains keywords like 'IEX', 'Invoke-Expression', or '.ps1', suggesting the execution of a script or expression.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
Page 431 of 509