Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the launch or execution of common remote access tools such as AnyDesk, TeamViewer, Quick Assist, or Microsoft Remote Assistance (msra.exe) on an endpoint, excluding instances where these tools act as the parent process. This rule serves as one component of a broader detection chain for potentially unauthorized remote access.
Detects a suspicious sequence of events suggesting potential technical support scam or social engineering activity: a rapid influx of emails (email bombing) followed by an external Microsoft Teams call, and subsequently the execution of a common remote access tool on the same host within a short timeframe.
Detects the execution of AnyDesk or its installation from common user-writable directories (Downloads or AppData), as well as scenarios where a browser (msedge.exe) initiates an AnyDesk-related download. This is a common indicator of unauthorized remote access tool deployment.
Detects the use of the Windows certutil utility to decode Base64-encoded files into executable, library, or script formats. This technique is commonly used by adversaries to decode malicious payloads that were dropped on a system in an encoded form to bypass signature-based security controls.
Detects the execution of MSBuild.exe with command line arguments pointing to project files (.xml or .csproj) that contain C# inline task structures (e.g., CodeTaskFactory, UsingTask). This technique is commonly used to proxy malicious code execution via a trusted Microsoft binary, bypassing certain application control policies.
Detects instances of rundll32.exe being executed with command line arguments that point to DLLs in common user-writable or non-standard directories (e.g., Temp, AppData, Downloads, ProgramData) or employing known malicious command patterns like Control_RunDLL, javascript: protocol handlers, or shell32.dll proxy execution techniques often used to evade security controls.
Detects msiexec.exe execution with flags intended for silent or standard installation when the source path points to a remote web resource (HTTP/HTTPS) or a UNC path. This behavior is indicative of using the native Windows Installer to proxy the download and execution of arbitrary, potentially malicious, MSI packages.
Detects the use of bitsadmin.exe to create or modify Background Intelligent Transfer Service (BITS) jobs, specifically when combined with the /setnotifycmdline flag. This technique is used by adversaries to download malicious payloads and trigger their execution upon job completion, often bypassing network security controls that might otherwise flag traditional download-and-execute activity.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to initiate process creation on remote hosts. This is achieved by combining the '/node:' flag (to specify a remote target) with the 'process call create' command. This technique is frequently utilized by adversaries and ransomware operators for lateral movement across a Windows network.
Detects the execution of the Windows built-in utility mshta.exe when it is used to load remote HTA files or scripts via HTTP/HTTPS URLs, or when it is directly spawned by Microsoft Office applications (Word/Excel). This behavior is characteristic of malicious document macros or phishing-based initial access where mshta is used as a proxy to execute code and evade security controls.
Detects the execution of Regasm.exe or Regsvcs.exe where the target assembly is located in a path other than standard Windows or .NET framework directories. This behavior is often indicative of an adversary attempting to use these signed utilities to load and execute malicious .NET payloads as a proxy, thereby bypassing application allowlisting.
Detects the execution of csc.exe (C# compiler) from non-standard directories or when compiling source files located in user-writable paths like Temp or AppData. This behavior is indicative of on-host code compilation used by attackers to bypass static antivirus detection by delivering and compiling malicious payloads on the fly.
Detects suspicious execution patterns of rundll32.exe, including usage for JavaScript execution, control panel file abuse, potential credential dumping using comsvcs.dll, and execution from common user-writable temporary directories.
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) with suspicious command-line parameters (using remote INF files via UNC or HTTP) or when it spawns unexpected child processes, both of which are indicative of potential bypass of User Account Control (UAC) or security controls.
Detects rapid, multi-category reconnaissance activity initiated by AI-agent binaries (e.g., Claude, Cursor, ChatGPT). The rule identifies sessions that perform four or more distinct discovery operations—spanning account, network service, system information, and network configuration discovery—within a short time window, indicating potentially malicious autonomous exploration by an AI agent. Covers T1046, T1087, T1083, T1016
Detects rapid, multi-category reconnaissance activity initiated by AI-agent binaries (e.g., Claude, Cursor, ChatGPT). The rule identifies sessions that perform four or more distinct discovery operations—spanning account, network service, system information, and network configuration discovery—within a short time window, indicating potentially malicious autonomous exploration by an AI agent. Covers T1046, T1087, T1083, T1016
Detects rapid, multi-category reconnaissance activity initiated by AI-agent binaries (e.g., Claude, Cursor, ChatGPT). The rule identifies sessions that perform four or more distinct discovery operations—spanning account, network service, system information, and network configuration discovery—within a short time window, indicating potentially malicious autonomous exploration by an AI agent. Covers T1046, T1087, T1083, T1016
Detects rapid, multi-category reconnaissance activity initiated by AI-agent binaries (e.g., Claude, Cursor, ChatGPT). The rule identifies sessions that perform four or more distinct discovery operations—spanning account, network service, system information, and network configuration discovery—within a short time window, indicating potentially malicious autonomous exploration by an AI agent. Covers T1046, T1087, T1083, T1016
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Page 60 of 465