Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,438
11,829
5,873
5,150
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk.
The following analytic identifies the execution of the Windows built-in tool FSUTIL with the "FSINFO" or "Volume" parameters, in order to discover file system and disk information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. Monitoring this activity is significant because FSUTIL can be abused by adversaries to gather detailed information about the file system, aiding in further exploitation. If confirmed malicious, this activity could enable attackers to map the file system, identify valuable data, and plan subsequent actions such as privilege escalation or persistence.
The analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment.
The analytic detects the execution of rundll32 with a call to the user32 DLL, specifically the UpdatePerUserSystemParameters function. This function is responsible for updating system parameters, such as desktop backgrounds, display settings, and visual themes. This activity can be significant as it is an uncommon way to apply settings and has been observed as part of Rhysida Ransomware activity. If confirmed malicious, this could allow an attacker to disguise activities or make unauthorized system changes, potentially leading to persistent unauthorized access.
The analytic detects the execution of rundll32.exe when it calls specific DLLs (Advpack.dll, Ieadvpack.dll, Syssetup.dll, Setupapi.dll) with particular functions ("LaunchINFSection", "InstallHinfSection", "SetupInfObjectInstallAction"). This activity is significant as it indicates a potential application control or whitelisting bypass, allowing script code execution from a file. If confirmed malicious, an attacker could execute arbitrary code, potentially leading to privilege escalation, persistence, or further network compromise. The detection relies on Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions and process details.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
The analytic detects the creation or enabling of services on Linux platforms using the `systemctl` or `service` tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.
The analytic detects the execution of a batch command designed to recursively delete files or directories, a technique often used by ransomware like Reddot to delete files in the recycle bin and prevent recovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific flags for recursive and quiet deletions. This activity is significant as it indicates potential ransomware behavior aimed at data destruction. If confirmed malicious, it could lead to significant data loss and hinder recovery efforts, severely impacting business operations.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.
Detects the execution of NeutralinoJS framework components ('neutralino.exe', 'node.exe') from non-standard directories. This behavior is associated with the EvilAI campaign, where threat actors leverage the NeutralinoJS framework to execute arbitrary JavaScript code for covert data access and process spawning. The detection specifically looks for the '--load-dir-res' argument, which is a strong indicator of a NeutralinoJS application launch, and filters out executions from standard application installation directories to focus on anomalous locations, which can indicate malware masquerading as a portable app or running from a temporary/user location.
The analytic detects instances where `vbc.exe`, the Visual Basic Command Line Compiler, initiates DNS queries. Normally, `vbc.exe` operates locally to compile Visual Basic code and does not require internet access or to perform DNS lookups. Therefore, any observed DNS activity originating from `vbc.exe` is highly suspicious and indicative of potential malicious activity. This behavior often suggests that a malicious payload is masquerading as the legitimate `vbc.exe` process to establish command-and-control (C2) communication, resolve domains for data exfiltration, or download additional stages of malware. Security teams should investigate the process's parent, command-line arguments, and the resolved domains for further indicators of compromise.
Page 476 of 564