Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,831 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
9,731
2,539
1,169
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,774
3,899
2,669
2,013
1,826
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects the execution of heavily obfuscated PowerShell, characteristic of the MAYBEROBOT backdoor. COLDRIVER uses this script, often via a logon script for persistence, to download and execute further commands. The rule specifically looks for a combination of string replacement functions ('-replace', '\n', ';', '[^\x20-\x7E]') used by MAYBEROBOT for de-obfuscation before execution.
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRS) and may indicate potential lateral movement activity. The rule specifically filters out 'conhost.exe' as a common benign child process.
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Detects a User Account Control (UAC) bypass attempt using the CMSTP COM interface. This specific rule looks for the process chain associated with the ValleyRAT campaign, where bypass.exe uses this technique to launch Nvidia.exe with elevated privileges.
Detects PowerShell execution patterns consistent with the Caminho Loader, which uses LSB steganography to extract a payload from a downloaded image file. This rule requires PowerShell Script Block Logging (Event ID 4104).
Detects a process execution where the parent process is explorer.exe and its command line indicates it is launching an LNK file from within a ZIP archive. This is a common TTP for initial access, where users are tricked into opening malicious LNK files embedded in ZIP archives. This version specifically looks for rundll32.exe as the child process, which is a common technique for proxy execution.
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
Detects potential exploitation of the PwnKit vulnerability (CVE-2021-4034) by looking for specific keywords in authentication logs. The rule identifies attempts to execute 'pkexec' with suspicious environment variable content and specific user/TTY information, indicative of a local privilege escalation attempt.
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
This rule detects the execution of arbitrary commands via the Windows Subsystem for Linux (WSL) by monitoring process creation events where 'wsl.exe' is the executable. It specifically looks for command lines that include flags like '--exec' or '-e', or common shell commands and downloaders such as 'curl', 'wget', 'bash -c', 'sh -c', 'nc ', or 'ncat '. This activity can indicate an adversary leveraging WSL to execute malicious code or bypass security controls.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the use of BITSAdmin to download a remote file with a potentially malicious extension. This technique is used by COLDRIVER's NOROBOT malware to retrieve subsequent stages.
Detects the execution of 'curl.exe' with command-line arguments indicating the use of SOCKS proxies (socks5h, socks5, socks4a) and targeting '.onion' domains. This combination is highly indicative of activity associated with the Kalambur backdoor, which leverages TOR for command and control.
This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
Detects the execution of a shell command characteristic of APT36's use of malicious .desktop files on Linux. The command typically involves using 'curl' to download a hex-encoded payload and 'chmod' to make it executable, often within the a tmp directory.
Page 467 of 564