Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
Detects host-based network reconnaissance behaviors commonly associated with the threat group APT36 (Transparent Tribe). The rule identifies the execution of various built-in Windows network discovery commands including arp, nbtstat, net view/share/session, and automated ping sweeps or PowerShell-based subnet enumeration scripts, which are used to map reachable hosts and network shares.
Detects the modification of network interface IP addresses using netsh or PowerShell cmdlets. This activity can be associated with unauthorized network configuration changes, static IP assignment for persistence, or evasion techniques.
Detects the execution of the Windows cipher.exe utility with the '/w' flag from the command prompt. The '/w' flag is used to overwrite free space on a disk, which is a technique often used by adversaries to perform data destruction or hinder forensic recovery of deleted files.
This rule monitors process creation events for suspicious activity, specifically detecting two patterns: 1) The creation of a scheduled task named 'OneDrive KeepAlive' using schtasks.exe, which is indicative of persistence mechanisms masquerading as legitimate software, and 2) Execution of the 'taskhostw.exe' binary with command-line arguments 'exec' and 'hide', which is a common indicator of the NirCmd utility being renamed and used for stealthy execution.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects DragonForce ransomware behavior where the binary is copied to a staging directory (typically C:\Users\Public\) and subsequently registered as a persistent, one-time execution scheduled task with SYSTEM privileges using COM interfaces or schtasks.exe.
Detects attempts to delete Volume Shadow Copies using native Windows administrative tools such as wmic.exe and vssadmin.exe. This activity is frequently associated with ransomware, as adversaries often delete local backups to prevent data recovery.
This rule detects the execution of the legacy finger.exe utility when spawned by common user-facing applications (e.g., browsers, shells, explorer). The detection specifically looks for instances where the command line includes an '@' character, indicating an attempt to query information from a remote host, while excluding standard localhost queries. This pattern is often associated with reconnaissance activity or enumeration of remote users/systems.
Detects anomalous child processes spawned by the Microsoft Exchange IIS worker process (w3wp.exe). This activity is often observed during post-exploitation phases of vulnerabilities like ProxyLogon (CVE-2021-26855), where attackers attempt to gain code execution by spawning command shells or administrative tools from the web server process.
Detects unexpected child processes spawned from directories associated with AI coding agent plugins (e.g., Claude Code, Copilot, Codex, Gemini CLI). This activity could indicate post-exploitation behavior, such as Plugin4Shell, where a malicious plugin auto-update facilitates remote code execution.
Detects execution of long, obfuscated command strings initiated by Windows Explorer, often indicative of the 'ClickFix' social engineering technique where users are tricked into copying and pasting malicious commands into the Windows Run dialog.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite free space on a volume to permanently delete data, a common technique for anti-forensics and data destruction.
Detects PowerShell processes spawned from Windows Script Host (wscript.exe/cscript.exe) that interact with environment variables starting with 'Kv'. This behavior is indicative of the LausivLoader malware, which passes data between script stages via inherited environment variables to avoid using command-line arguments.
Detects execution of Windows command shells (cmd.exe, powershell.exe) performing suspicious file deletion or renaming operations involving specific filenames associated with potentially malicious activities or malware components.
Detects the use of the 'net.exe' command-line utility to connect to the hidden IPC$ administrative share on a remote system, which is a common technique used for lateral movement and remote reconnaissance.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects the inclusion of PowerShell download commands ('irm' or 'Invoke-RestMethod') within the Windows 'RunMRU' registry key. This key is used by Windows Explorer to track recently typed run commands, and adversaries often abuse it to maintain persistence or store malicious one-liner payloads that are intended to be executed at a later time.
Detects the execution of suspicious image files (often masquerading as lures) using explorer.exe from the user Downloads directory. This is a common pattern for launching malicious payloads delivered via phishing.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
This rule detects the creation of a scheduled task via schtasks.exe that uses a name similar to 'Google Chrome Update' but is initiated by a process other than the legitimate Google Update executable or from an unexpected folder location. This behavior is commonly used by adversaries to establish persistence while masquerading as legitimate software update mechanisms.
Page 7 of 29