Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,695
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects instances where WScript.exe or CScript.exe spawn PowerShell.exe as a child process. The rule specifically looks for command-line arguments indicative of policy bypass (-ExecutionPolicy Bypass) and remote payload retrieval (Invoke-WebRequest, DownloadString), which is a common pattern in obfuscated JavaScript-based infection chains.
Detects the execution of Microsoft-signed .NET utilities (RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, AspNet_Compiler) when spawned by scripting engines like PowerShell, wscript, or cscript. This behavior is indicative of the Veil#Drop framework using trusted developer utilities as a fallback mechanism to execute secondary payloads or bypass security controls.
Detects the use of [ScriptBlock]::Create() within PowerShell command lines. This method allows for the dynamic construction and execution of arbitrary PowerShell code entirely in memory, a technique often used by fileless malware and frameworks like Veil#Drop to evade disk-based detection mechanisms.
Detects the potential creation or execution of malicious JavaScript files that masquerade as PDF or other common documents using double extensions (e.g., .pdf.js). This behavior is often associated with file-based loaders where the operating system masks the true file extension. The rule also triggers when these files are explicitly launched via Windows Script Host (wscript.exe or cscript.exe).
Detects the execution of mshta.exe with command-line arguments that reference VLC-themed filenames or presentations. This behavior is indicative of a malicious HTA file being used as a lure to drop the Lightlife RAT loader, leveraging the mshta.exe utility to bypass standard application execution controls.
Detects the execution of PowerShell with a combination of flags commonly used to hide malicious activity: -NoProfile, -WindowStyle Hidden, and -EncodedCommand. This combination is frequently used by adversaries to execute obfuscated code silently, bypassing user visibility and script analysis.
Detects the creation of .bat files within the Windows Startup folder. Adversaries often use this technique to achieve persistence by ensuring a script executes automatically upon user login.
Detects AutoIT executables running from a Temp directory that take an .ini file as a command-line argument. This pattern is commonly used by AutoIT-based malware loaders or droppers to ingest configuration files containing obfuscated code or C2 communication parameters.
Detects the execution of PowerShell with suspicious command-line flags often associated with malicious scripts (e.g., hidden windows, no profile, bypassed execution policies) when the script is located in the Windows Temporary directory.
Detects instances of the Windows Character Map utility (charmap.exe) loading graphics-related libraries such as System.Drawing.dll or gdiplus.dll. These modules are typically not required by charmap.exe and their loading is a common indicator of process injection for the purpose of capturing the screen or desktop interface.
Detects instances where PowerShell.exe spawns the .NET C# compiler (csc.exe) with command-line arguments referencing a '.cmdline' file. This pattern is commonly used by adversaries to compile malicious code in-memory, bypassing traditional disk-based file scanning.
Detects the execution of suspected Hidden VNC (HVNC) backdoor components that demonstrate behaviors consistent with banking credential theft, specifically targeting keystroke logging APIs. The rule monitors for specific process names executing from suspicious directories often used for persistence.
This rule detects the presence of the 'antiSNG' flag in command-line arguments of newly created processes. This flag is specific to the configuration of Hannibal Stealer, which uses it to perform anti-analysis checks, likely related to geofencing or environmental detection to evade sandbox or security analyst investigation.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects PowerShell command lines that simultaneously utilize .NET cryptography classes (TripleDES or AES) for decryption and runspace pipeline creation. This pattern indicates an in-memory execution technique where malicious payloads are decoded and executed directly within the PowerShell process, effectively bypassing disk-based security controls.
Detects the ClickFix social-engineering technique where an adversary tricks a user into pasting and executing a malicious command via Windows Explorer (Run dialog) or Windows Terminal. This pattern is often used in fake CAPTCHA or job-interview lures to achieve initial code execution.
Detects instances where the Firefox browser process executes from a path containing 'ProgramData' and creates a new file within the 'ProgramData' directory. This behavior is highly suspicious as legitimate Firefox installations reside in 'Program Files' or 'Program Files (x86)', and 'ProgramData' is often abused by malware for persistent storage or staging.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
Page 73 of 465