Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.
Detects execution of the Microsoft InstallUtil.exe utility with suspicious command-line arguments (logging suppressed to file and console) where the binary is unsigned. This is a common technique used by adversaries to proxy execution of arbitrary .NET code while attempting to avoid detection and maintain stealth.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
This rule detects the execution of potentially malicious commands launched directly from the Windows File Explorer address bar. By analyzing DeviceProcessEvents, it identifies when explorer.exe spawns common command-line utilities (powershell.exe, cmd.exe, etc.) with arguments often associated with malicious activity, such as remote script downloads, encoded commands, or bypass flags.
This rule detects suspicious processes (e.g., cmd.exe, powershell.exe, curl.exe) or the execution of vaultcmd.exe accessing browser credential files (Login Data, Web Data, logins.json, key4.db) or utilizing DPAPI (CryptUnprotectData) to extract stored credentials. This behavior is indicative of credential harvesting often observed in infostealer campaigns.
Detects native Windows command and scripting interpreters (e.g., cmd.exe, powershell.exe, mshta.exe) initiating external network connections to multiple distinct IP addresses, which is often an indicator of automated C2 beaconing or lateral movement activity.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
This rule detects various commands and processes used by adversaries to enumerate virtual machine software, hypervisor configurations, and virtualization-based security features on a host. This is often part of reconnaissance to understand the environment, detect sandboxing, or identify virtualization platforms for further post-exploitation activities.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects the PowerShell downloader stage of the abdrizak PostCSS typosquatting campaign. The malware decodes an AES-encrypted blob in the npm package and executes powershell with ExecutionPolicy Bypass targeting settings.ps1, or invokes curl.exe (from node.exe or powershell.exe) to download a payload from nvidiadriver.net disguised as a Windows driver update.
Detects archiving utilities (WinRAR, 7z, zip) executing via command line to recursively compress sensitive user directories (Desktop, Documents, Downloads) into staging folders, which is a common technique for data exfiltration.
Page 476 of 974