Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
Detects the execution of 'DiscordDial.vbs' by 'wscript.exe' or 'cscript.exe'. This script is identified as a helper script used for persistence.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Detects wscript executing SyncAppvPublishingServer.vbs, which has been observed in campaigns delivering ClearFake payloads. This rule specifically looks for the execution of 'wscript.exe' with 'SyncAppvPublishingServer.vbs' in its command line.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Detects rundll32.exe loading davclnt.dll triggered by a .wsh script for WebDAV access. This activity can be indicative of an adversary attempting to force authentication to capture credentials or to facilitate ingress tool transfer.
Parses Python execution strings to detect inline, on-the-fly decompression and execution of the CastleLoader script without touching disk.
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Detects pythonw.exe running compiled Python bytecode (.pyc) specifically from attacker-generated staging directories in ProgramData. The rule looks for specific directory names (Ccrreewwll, NewKevinNotAnother, NewestWorkiNaprav) followed by an alphanumeric string and a .pyc extension within the ProgramData directory.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Detects the execution of MeshCentral's command-line utility via Node.js, a technique observed in ShinyHunters attacks against Oracle PeopleSoft servers.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects the execution of VBScript or JScript files (via wscript.exe or cscript.exe) where the command line contains common VBScript argument handling keywords. This pattern can indicate malicious script execution attempting to parse arguments for further actions, potentially as part of a phishing attack or malware execution chain.
Detects the creation of WMI event subscriptions, which can be used by adversaries for persistence. The rule specifically looks for command-line arguments related to WMI namespace manipulation or PowerShell cmdlets for WMI event creation.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
This rule detects the creation of scheduled tasks (Event ID 4698) that are configured to execute scripting languages (PowerShell, cmd, Python, Java) with hidden window styles. This behavior is often indicative of an adversary attempting to establish persistence while evading detection by hiding the execution of their malicious scripts.
Detects injection of malicious scripts into legitimate websites for watering hole attacks
Page 131 of 191