Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,703
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects the invocation of common command-line interpreters (PowerShell or Windows Command Shell) via process creation events. This is a broad detection for administrative shell activity, which may also indicate malicious script execution or manual adversary interaction.
Detects the loading of the kernel driver 'Alinubx.sys', identified as a renamed instance of the 'CcProtect.sys' driver. This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, specifically observed in the context of Rapuncel infostealer campaigns.
This rule detects the execution of known Remote Monitoring and Management (RMM) tools across the environment. RMM tools are frequently used by IT administrators for legitimate support, but are also commonly abused by threat actors to establish persistence and gain remote access to systems. The rule tracks the first instance of these processes appearing on any device within a 30-day window.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
Detects the execution of LNK files that use a double extension (e.g., .pdf.lnk) to masquerade as PDF documents. This behavior is indicative of spear-phishing campaigns where malicious shortcuts are delivered via ZIP archives to execute hidden PowerShell commands for secondary stage downloader or persistence mechanisms.
Detects the execution of VelvetCake modular scripts by PowerShell, which involves downloading and executing scripts from %TEMP% via Invoke-Expression, and monitoring the C:\Users\Public directory for file staging and subsequent exfiltration. This rule captures the tactical loop of script execution, output file creation, and exfiltration preparation often observed in Operation Conflict Compass activity.
Detects unexpected child process execution spawned by the ScreenConnect ClientService. This activity is indicative of the exploitation of CVE-2026-84869, which allows for unauthorized file transfer and arbitrary code execution within the context of the remote support agent without requiring user interaction or confirmation.
Detects the execution of a process named 'msedge.exe' from the 'ProgramData\Microsoft\Windows\Telemetry' directory. Legitimate Microsoft Edge executables do not run from this location, suggesting an attempt to masquerade as the legitimate browser to bypass security controls or evade detection.
This rule detects modifications to Microsoft Defender antivirus exclusions. Adversaries often add paths or files to the exclusion list to prevent the detection of malicious tools or staging folders during cyberattacks. The rule monitors both command-line execution of PowerShell (Add-MpPreference/Set-MpPreference) and direct registry modifications related to Windows Defender paths.
Detects the HEAVYGRAM second-stage implants 'RuntimeSSH.exe' or 'winappx.exe' establishing persistence by adding entries to Windows Registry Run or RunOnce keys.
Detects execution of potential MovieReaper loader components by monitoring for the creation of a specific, statically defined global mutex or patterns indicative of dynamic mutex naming conventions often used to ensure single-instance execution by malware.
This rule detects instances where Windows scripting engines (WScript or MSHTA) execute script files (WSF, VBS, HTA) which subsequently spawn a PowerShell process using encoded command arguments. This pattern is commonly used by adversaries to mask malicious payloads and bypass execution policy or simple command-line monitoring.
This rule detects Windows executable files that attempt to masquerade as legitimate software installers for Telegram, KeePass, or Pictory. These filenames and branding artifacts are associated with social engineering campaigns known to distribute malware families such as HEAVYGRAM and CRUDEEXCLUDE.
Detects execution of PowerShell with a hidden window and base64-encoded command arguments that targets the file 'WindowsUpdate.log'. This pattern is associated with the CRPx0 (ClickFix) ransomware, where it attempts to drop or interact with a stager file disguised as a legitimate Windows update log file.
Detects instances where PowerShell or mshta.exe are launched by a web browser or Windows Explorer, often indicative of the 'ClickFix' social-engineering campaign. In this scenario, users are tricked into copying and pasting malicious commands from a fake CAPTCHA or update prompt directly into a Windows terminal or the Run dialog, leading to code execution.
This rule detects the use of standard Windows administrative utilities (wmic.exe, vssadmin.exe, and wbadmin.exe) to perform destructive operations on volume shadow copies or backup catalogs. These actions are frequently associated with ransomware attacks to prevent system recovery.
Detects the execution of Active Directory Explorer (ADExplorer.exe or ADExplorer64.exe), a legitimate tool often repurposed by adversaries to enumerate Active Directory structures, accounts, and group memberships.
Detects the invocation of SQL Server Management Studio (ssms.exe) by the PsExec or PsExec service process. This behavior is indicative of administrative tools being used for potentially unauthorized remote execution or lateral movement.
Detects the presence or installation of 'truesight.sys' or 'rentdrv2.sys' drivers, which are associated with malicious activity. The rule also triggers when system utilities like sc.exe or services.exe are used to set services related to these names to a 'demand' start type, indicating potential persistence or malicious driver loading.
This rule detects instances where PowerShell is used to download or execute remote monitoring and management (RMM) tools or remote access software binaries (e.g., AnyDesk, TeamViewer, Atera). This pattern is often indicative of an adversary attempting to establish persistent remote access to a compromised system after initial intrusion.
Page 80 of 465