Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) spawns unexpected command shells or script interpreters. This is a strong indicator of post-exploitation activity following CVE-2026-41089 exploitation.
This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.
Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.
Detects process command lines executing an `_index.js` payload using the Bun runtime, which is characteristic of the Hades stealer's execution chain where a Python loader downloads Bun to execute an obfuscated JavaScript payload.
This rule detects attempts to hijack the clipboard on a web page by identifying HTTP responses (flow:to_client) that contain both 'clipboardData' and 'setData' (case-insensitive) in the file data. This combination of keywords suggests a script attempting to read from and write to the client's clipboard, which is a common technique for clipboard hijacking.
Detects privilege escalation attempts utilizing PowerShell's Start-Process cmdlet with the 'RunAs' verb. This technique can be used by malware like Lucid Stealer's UAC module to elevate privileges.
Detects system scripts like PubPrn used as execution proxies for defense evasion
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects suspicious command-line activity involving 'cscript' or 'wscript' (Windows Script Host) combined with keywords like 'download', 'execute', or 'powershell'. A high count of such events (3 or more within 5 minutes) from the same computer and account is flagged, indicating potential exploit kit activity, malicious script execution, or initial access attempts.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects process execution indicative of the npm binding.gyp GYP shell expansion exploit used in the Miasma campaign to silently run node. This rule specifically looks for Node.js process executions with a command line matching a unique regex pattern associated with the exploit: 'node index.js > /dev/null 2>&1 && echo stub.c'.
Detects the creation of a scheduled task intended to execute a VBScript (.vbs). This technique is notably used by a North Korean-linked npm infostealer RAT to establish login persistence via a hidden VBS launcher.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Detects the execution of the initial fingerprinting PowerShell script utilized by the PhantomRelay RAT. PhantomRelay is a custom Remote Access Trojan associated with the Russia-nexus threat group GREYVIBE. The script gathers system information such as computer name, username, and PID, using a hardcoded User-Agent string before connecting to the C2 server.
Detects the execution of the LegionRelay client script, a PowerShell RAT utilized by the Russia-nexus threat group GREYVIBE. LegionRelay communicates with its command-and-control server via REST API methods and relies on operator-staged scripts for post-compromise activity. The detection matches on specific REST API paths and PowerShell artifacts found within the script block.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Page 136 of 191