Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
This rule detects modifications to the 'DelegateExecute' registry value within the 'HKCU\Software\Classes\Folder\shell\open\command' key. This specific registry modification is a known technique used for COM hijacking, often leveraged in UAC bypasses, such as those involving sdclt.exe. An attacker can modify this key to execute an arbitrary program when a user attempts to open a folder, leading to persistence or privilege escalation.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
Detects the execution of PowerShell, VBScript, PHP, JavaScript, or WSF scripts from the 'AppData\Local\Temp' directory by common Windows processes like explorer.exe or svchost.exe. This behavior can indicate malicious activity where scripts are dropped into temporary locations and then executed.
Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
Detects file association changes using the built-in "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
Detects when the `assoc` command-line utility is used to change the default file association of any extension to an executable (`exefile`). This technique can be used by adversaries for persistence or privilege escalation by making a specific file type execute a malicious program when opened.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
Detects the installation of malicious npm packages, such as 'node-nvm-ssh', used by the Famous Chollima group. The detection focuses on suspicious post-install scripts executed by node.exe, which is a known TTP for this actor to deliver malware like BeaverTail and OtterCookie.
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. This activity is often used to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.
Detects the addition of users to the local 'Remote Desktop Users' group using either the 'net localgroup' command or the 'Add-LocalGroupMember' PowerShell cmdlet. This activity can indicate an adversary attempting to establish persistence or facilitate lateral movement via Remote Desktop Protocol.
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.
The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.
Page 470 of 564