Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of 'wevtutil.exe' with the 'cl' or 'clear-log' arguments targeted at primary Windows Event Logs (Security, System, or Application). This activity is commonly associated with an adversary attempting to clear audit logs to conceal malicious actions during an intrusion.
Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects execution of regsvr32.exe with command line arguments commonly used to execute remote scriptlets (SCT files) via HTTP/HTTPS, bypassing application control by leveraging a trusted Microsoft binary.
Detects the use of Windows utilities 'nltest.exe' and 'dsquery.exe' with specific command-line arguments to enumerate Active Directory domain trust relationships. This behavior is indicative of an attacker attempting to map the network environment to identify targets for lateral movement.
Detects the use of cmstp.exe with suspicious command-line arguments (e.g., .inf file references or silent/unattended flags) often associated with bypass of application control or User Account Control (UAC).
This rule detects the use of the 'powercfg.exe' utility by non-system accounts to modify power settings, such as disabling hibernation, modifying standby/sleep timeouts, or changing monitor/disk timeout configurations. Such actions can be indicative of attempts to maintain system availability, prevent the system from entering a low-power state that might terminate malicious processes, or ensure persistent execution of unauthorized activities.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
This rule detects the use of the 'powercfg.exe' utility by non-system accounts to modify power settings, such as disabling hibernation, modifying standby/sleep timeouts, or changing monitor/disk timeout configurations. Such actions can be indicative of attempts to maintain system availability, prevent the system from entering a low-power state that might terminate malicious processes, or ensure persistent execution of unauthorized activities.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.
Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.
Detects the use of reg.exe to query the Windows registry for information related to software versions or service configurations. This activity is often associated with discovery efforts to identify installed software, system configuration, or potential security controls.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.
Page 475 of 974