Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
This rule detects the execution of PowerShell, wscript, or cscript with command-line arguments containing "Invoke-WebRequest" or "curl" in conjunction with specific keywords like "guloader", "etherhiding", or "clickfix". This combination suggests an attempt to download or execute malicious payloads associated with these campaigns or malware families.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
This rule detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell. It specifically looks for multiple executions of these tools within a 5-minute window, originating from non-system accounts and not from standard Windows system directories. This behavior can indicate lateral movement or other malicious activity within a network.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects the execution of the 'sqlagent_escalate.py' tool, which is known to be used by the MuddyWater threat group for SQL escalation. This rule specifically looks for the presence of 'sqlagent_escalate.py' in process command lines.
Detects the execution of a PowerShell script named 'nm.ps1', which has been associated with the Seedworm threat group for staging purposes. This rule specifically looks for 'nm.ps1' within process command lines.
Detects obfuscated JavaScript code indicative of STRRAT malware.
Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
Page 116 of 191