Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
The following analytic identifies attempts to disable Windows Defender real-time behavior monitoring via PowerShell commands. It detects the use of specific `Set-MpPreference` parameters that disable various security features. This activity is significant as it is commonly used by malware such as RATs, bots, or Trojans to evade detection by disabling antivirus protections. If confirmed malicious, this action could allow an attacker to operate undetected, leading to potential data exfiltration, further system compromise, or persistent access within the environment.
The analytic detects the execution of Regsvr32.exe with the silent switch (`-s` or `/s`) to load DLLs. This behavior is commonly used in malware campaigns, such as IcedID, to stealthily load malicious DLLs, allowing attackers to execute arbitrary code, download additional payloads, and potentially compromise the system. The detection leverages Endpoint Detection and Response (EDR) telemetry, specifically focusing on command-line executions.
The following analytic detects the execution of `wmic.exe` with specific command-line arguments used to discover remote systems within a domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to map out network resources and Active Directory structures. If confirmed malicious, this behavior could allow attackers to gain situational awareness, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.
The analytic detects the execution of `wmic.exe` with the `node` switch, indicating an attempt to spawn a local or remote process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, the attacker could gain remote control over the targeted system, execute arbitrary commands, and potentially escalate privileges or persist within the environment.
This analytic detects the execution of the rundll32.exe command with the user32.dll,LockWorkStation parameter. This specific command is used to lock the workstation via the command line, which is an uncommon method. This activity has been observed in CONTI ransomware tooling for defense evasion purposes. If confirmed malicious, this technique could indicate an attempt to evade detection and hinder incident response efforts.
This analytic identifies instances where the `reg.exe` utility is launched from a command prompt (`cmd.exe`) that was not initiated by a user, specifically when the parent process is not `explorer.exe`. This activity is significant because `reg.exe` is commonly used for registry manipulation, which can be indicative of malicious behavior such as establishing persistence mechanisms or altering system configurations. If confirmed malicious, this could allow an attacker to modify critical system settings, potentially leading to privilege escalation or persistent access.
The analytic detects the execution of `powershell.exe` with command-line arguments that use PowerShell environment variables to identify the current logged user. This activity is significant as adversaries may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to gather critical user information, aiding in further exploitation and lateral movement within the network.
The analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network.
The following analytic detects the execution of `whoami.exe` with the `/priv` parameter, which displays the privileges assigned to the current user account. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an adversary attempting to enumerate user privileges, a common step in the reconnaissance phase of an attack. If confirmed malicious, this could lead to privilege escalation or further exploitation within the environment.
The analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. This activity is significant as it may indicate an attempt by adversaries to enumerate user accounts for situational awareness or Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
The analytic detects the execution of JScript using the cscript.exe process. This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
The analytic detects the loading of a DLL using the regsvr32 application with the silent parameter and DLLInstall execution. This activity is commonly used by RAT malware like Remcos and njRAT to load malicious DLLs on compromised machines. If confirmed malicious, this technique could allow attackers to execute arbitrary code, maintain persistence, and further compromise the system.
The following analytic detects the execution of `powershell.exe` using the `Invoke-WmiMethod` cmdlet to start a process on a remote endpoint via WMI. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry. This activity is significant as it indicates potential lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, leading to further compromise and persistence within the network.
This analytic identifies the resizing of shadow storage volumes, a technique used by ransomware like CLOP to prevent the recreation of shadow volumes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "vssadmin.exe" with parameters related to resizing shadow storage. This activity is significant as it indicates an attempt to hinder recovery efforts by manipulating shadow copies. If confirmed malicious, this could lead to successful ransomware deployment, making data recovery difficult and increasing the potential for data loss.
This analytic detects the uninstallation of applications using msiexec.exe with specific command-line arguments. It focuses on process execution logs that include command-line details such as '/qn' (quiet mode), '/X' (uninstall), and 'REBOOT=' (reboot control). This activity is uncommon in enterprise environments and has been associated with malicious behavior, such as disabling security software to facilitate further compromise and persistence.
The analytic identifies unusually long command lines executed on hosts, which may indicate malicious activity. It leverages the Machine Learning Toolkit (MLTK) to detect command lines with lengths that deviate from the norm for a given user. This is significant for a SOC as unusually long command lines can be a sign of obfuscation or complex malicious scripts. If confirmed malicious, this activity could allow attackers to execute sophisticated commands, potentially leading to unauthorized access, data exfiltration, or further compromise of the system.
The following analytic detects the spawning of cmd or PowerShell processes by the wermgr.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process telemetry, including parent-child process relationships and command-line executions. This behavior is significant as it is commonly associated with code injection techniques used by malware like TrickBot to execute shellcode or malicious DLL modules. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
The analytic identifies the execution of `auditpol.exe` with the "/set" and "/exclude" command-line arguments. This indicates that a user's per-user policy will suppress auditing regardless of the system audit policy. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to exclude specific user events from log data. If confirmed malicious, this behavior could allow attackers to bypass defenses and plan further attacks, potentially leading to full machine compromise or lateral movement.
The analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. Monitoring this activity is significant as threat actors and post-exploitation tools like WINPEAS often abuse this command to gather network information. If confirmed malicious, this activity could allow attackers to map the network, identify DNS servers, and potentially facilitate further network-based attacks or lateral movement.
The analytic detects the use of the `net.exe` utility to disable a user account via the command line. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks.
This analytic detects the suspicious spawning of MSBuild.exe by Windows Script Host processes (cscript.exe or wscript.exe). This behavior is often associated with malware or adversaries executing malicious MSBuild processes via scripts on compromised hosts. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where MSBuild is a child of script hosts. This activity is significant as it may indicate an attempt to execute malicious code, potentially leading to unauthorized code execution and further compromise.
Page 98 of 100