Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects the execution of the MeshAgent remote management tool when renamed to 'mvtcs.exe'. This technique is often used by adversaries to maintain persistent remote access while evading basic file-name based detections.
Detects the creation of a .lnk shortcut file within the Windows Startup folder, which is a common persistence mechanism. The detection logic also flags the usage of WScript.Shell and CreateShortcut methods, which are frequently abused by scripts (e.g., VBScript or PowerShell) to programmatically establish this persistence.
Detects PowerShell instances performing suspicious memory operations like thread injection (e.g., VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) targeting common processes such as csc.exe, browser processes (chrome.exe, msedge.exe), and system processes like SearchIndexer.exe. This activity is indicative of malicious code injection often used in stealth execution and credential harvesting campaigns.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects instances of PowerShell being launched directly from Windows Explorer (explorer.exe) using suspicious command-line arguments. This pattern is commonly associated with malicious scripts, remote access trojans, or fileless execution techniques where an adversary executes code through shell-based file interaction.
Detects the creation of an LNK file in the Windows Startup directory, a common technique used to achieve persistence by executing a specific program or script upon user logon.
Detects PowerShell attempts to perform remote process injection into potentially suspicious or sensitive processes (csc.exe, chrome.exe, msedge.exe, SearchIndexer.exe) by searching for command line arguments indicating the usage of Windows memory allocation or thread context manipulation APIs such as NtAllocateVirtualMemoryRemote and NtSetContextThreadRemote.
Detects the execution of 'reagentc.exe' with the '/disable' flag, which is used to disable the Windows Recovery Environment (WinRE). Adversaries often perform this action as part of an attempt to inhibit system recovery during ransomware operations or other destructive attacks.
Detects execution of long, obfuscated command strings initiated by Windows Explorer, often indicative of the 'ClickFix' social engineering technique where users are tricked into copying and pasting malicious commands into the Windows Run dialog.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite free space on a volume to permanently delete data, a common technique for anti-forensics and data destruction.
Detects the execution of the Windows Recovery Environment (WinRE) management tool, reagentc.exe, with the '/disable' flag. This action disables the built-in system recovery features, which is a common tactic used by adversaries to prevent system restoration after data destruction or ransomware attacks.
This rule monitors and logs all process creation events across the environment. It captures the execution of every new process, regardless of the parent image or the binary being executed. Due to its broad scope, this rule acts as an observational baseline or telemetry collector rather than a high-fidelity detection.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
Detects instances where processes associated with Claude or Codex modify or create files within a plugin directory without a preceding legitimate installation or session command (such as 'install' or 'plugin add'). This behavior may indicate unauthorized plugin installation, persistence establishment, or malicious code injection into the development environment.
Detects the execution of obfuscated PowerShell commands initiated from the Windows Run dialog (explorer.exe). This pattern is consistent with 'ClickFix' social engineering attacks where users are coerced into copying and pasting malicious, obfuscated code into the Run dialog. The rule monitors for common obfuscation artifacts such as carets, hidden window flags, encoded command arguments, and large base64-like blobs within the command line.
Detects unauthorized write operations targeting the memory space of amsi.dll, specifically attempting to patch exported functions such as AmsiScanBuffer or AmsiScanString. This technique is commonly employed by malicious actors to neutralize the Antimalware Scan Interface (AMSI) and prevent security telemetry from inspecting scripts and payloads during execution.
Detects instances of vsdbg.exe (Visual Studio Debugger) loading vsdbg.dll from suspicious, temporary, or user-controlled locations (e.g., Temp, Downloads, AppData) when initiated from a path outside of the standard Microsoft Visual Studio installation directories. This behavior is indicative of potential masquerading or side-loading of the debugger utility by an attacker.
Detects Ruby processes executing with arguments explicitly disabling SSL/TLS verification (OpenSSL::SSL::VERIFY_NONE) while correlating with the presence of suspicious helper scripts ('loader.rb' or 'script.rb') within Ruby gem-related directories. This behavior is indicative of an adversary attempting to perform man-in-the-middle attacks or bypass security controls for outbound C2 communications.
Detects the execution of a process named 'hzwzucr_widsisa.exe' located within the 'AppData' directory. The rule further specifies that this process must be spawned by a command line initiated from 'C:\ProgramData\doxc' or by 'cmd.exe', indicating potentially suspicious activity common in malware deployment patterns.
Page 88 of 465