Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
This rule detects potentially malicious PowerShell behavior by correlating two events within a 5-minute window: first, a PowerShell process reading files from the C:\ProgramData directory, and second, the same process invoking sensitive memory manipulation APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx, GetDelegateForFunctionPointer). This pattern is commonly associated with fileless malware loaders or staging scripts that read encrypted payloads from disk and execute them in memory.
This rule detects common PowerShell command-line arguments and patterns used by attackers to bypass or disable Antimalware Scan Interface (AMSI) in memory. Attackers often attempt to modify non-public, static members of the AmsiUtils class to force AMSI initialization failure, allowing for the execution of malicious scripts without detection.
Detects the access of VPN configuration files (e.g., .ovpn, .vpn, vpn*.conf) by common Windows command interpreters (powershell, pwsh, cmd, wscript, mshta) or archivers (WinRAR). This behavior is often indicative of automated credential harvesting or malicious configuration exfiltration, as legitimate VPN clients are explicitly excluded from this rule.
This rule detects PowerShell execution attempts that include strings associated with Anti-Malware Scan Interface (AMSI) bypass techniques. Specifically, it searches for command-line arguments that attempt to manipulate memory (VirtualProtect, Marshal.WriteByte, RtlMoveMemory) or interact with AMSI/PowerShell internals (AmsiScanBuffer, amsi.dll) commonly used to disable AMSI scanning within a running process.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
This rule detects the execution of PowerShell with hidden window styles and encoded commands that is correlated with a concurrent update to Windows Registry Run or RunOnce keys. This combination is a common technique used by malware and adversaries to establish persistence on a host system.
Detects suspicious command-line execution patterns involving common SSH files and utilities, such as access to SSH keys, known_hosts, authorized_keys, or suspicious configuration flags. This pattern often indicates attempts to harvest SSH credentials, bypass host key checking, or facilitate persistent remote access. The rule specifically looks for these actions when performed by standard shell utilities or automated tools.
This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.
Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Detects execution of the EDRUnChoker remediation tool, useful for situational awareness. This rule specifically looks for the command line containing 'Install-EdrChokerWmiDefense.ps1', indicating the execution of a PowerShell script related to EDR evasion or manipulation.
Detects rapid screenshot capture and image encoding by a non-support process for live remote viewing, indicative of a Remote Access Trojan (RAT) like Banana RAT. The rule specifically looks for process command lines containing functions related to screen capturing (CopyFromScreen, BitBlt, Graphics.CopyFromScreen) and image encoding/streaming (JPEG, Bitmap, stream, frame, socket).
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
This rule detects attempts by non-browser executables to access DPAPI (Data Protection API) for decryption, specifically when the command line also references Chromium Local State. This behavior is indicative of credential theft, where an attacker might be trying to extract stored browser credentials. The rule filters out legitimate browser processes (Chrome, MS Edge, Brave) to reduce false positives and focuses on the causal chain of events.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Detects suspicious execution patterns involving SystemSettings.exe, specifically when spawned by uncommon binaries (xwreg.exe or xgdf.exe) or when performing thread creation operations, which may indicate process injection or suspicious lateral movement attempts.
Detects instances where the process SystemSettings.exe is executed from locations other than its legitimate path (Windows\ImmersiveControlPanel). This often indicates an attacker masquerading as a system utility to evade detection.
Page 57 of 100