Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
This rule detects the execution of potentially malicious commands launched directly from the Windows File Explorer address bar. By analyzing DeviceProcessEvents, it identifies when explorer.exe spawns common command-line utilities (powershell.exe, cmd.exe, etc.) with arguments often associated with malicious activity, such as remote script downloads, encoded commands, or bypass flags.
This rule detects suspicious processes (e.g., cmd.exe, powershell.exe, curl.exe) or the execution of vaultcmd.exe accessing browser credential files (Login Data, Web Data, logins.json, key4.db) or utilizing DPAPI (CryptUnprotectData) to extract stored credentials. This behavior is indicative of credential harvesting often observed in infostealer campaigns.
Detects native Windows command and scripting interpreters (e.g., cmd.exe, powershell.exe, mshta.exe) initiating external network connections to multiple distinct IP addresses, which is often an indicator of automated C2 beaconing or lateral movement activity.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects command lines consistent with ArachneC2 implant generation and hardening options.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
This rule detects various commands and processes used by adversaries to enumerate virtual machine software, hypervisor configurations, and virtualization-based security features on a host. This is often part of reconnaissance to understand the environment, detect sandboxing, or identify virtualization platforms for further post-exploitation activities.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects the PowerShell downloader stage of the abdrizak PostCSS typosquatting campaign. The malware decodes an AES-encrypted blob in the npm package and executes powershell with ExecutionPolicy Bypass targeting settings.ps1, or invokes curl.exe (from node.exe or powershell.exe) to download a payload from nvidiadriver.net disguised as a Windows driver update.
Detects archiving utilities (WinRAR, 7z, zip) executing via command line to recursively compress sensitive user directories (Desktop, Documents, Downloads) into staging folders, which is a common technique for data exfiltration.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Detects the execution of rundll32.exe initiated by explorer.exe where the command line references common user folders (AppData, Temp, Downloads) and includes suspicious file extensions (e.g., images, PDFs, Office docs). This pattern is often indicative of malicious code execution where an adversary uses rundll32.exe to proxy execution of payloads masked as benign files.
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
This rule detects potentially malicious behavior associated with web browser processes, including the execution of Python scripts, the loading of browser extensions from non-standard directories like AppData or Temp, the creation of Python scripts by browsers in temp folders, and outbound network connections by Python processes following browser activity. These patterns are often associated with browser-based exploitation, extension-based malware, or initial access stages where a browser is used as a conduit for malicious code execution.
Detects the execution of rundll32.exe initiated by explorer.exe where the command line references common user folders (AppData, Temp, Downloads) and includes suspicious file extensions (e.g., images, PDFs, Office docs). This pattern is often indicative of malicious code execution where an adversary uses rundll32.exe to proxy execution of payloads masked as benign files.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
Page 476 of 974