Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,453
11,838
5,876
5,154
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects suspicious command-line arguments used with Windows utilities (LOLBAS)
Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.
Detects the execution of scriptlet files or the use of scrobj.dll (squiblydoo)via command line, particularly when initiated by common scripting or command interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
KQL Query
Detects scripts modifying Windows registry run keys for establishing persistence
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
This rule detects the multi-stage installation and command-and-control (C2) activities associated with GhostClaw or GhostLoader malware on macOS systems. It correlates suspicious process executions, such as curl-based bootstrap, install.sh execution, user-space Node.js setup, and outbound network traffic to 'trackpipe.dev' with UUID-like pathing or specific NODE_CHANNEL values. The rule looks for a combination of at least three of these indicators within a two-hour window to reduce false positives.
This rule detects potential abuse of Microsoft Excel where a process other than Excel itself is launched by Excel. This behavior can be indicative of malicious Excel add-ins (XLLs) or macros executing external code, a common technique used in phishing campaigns and malware delivery. The rule specifically looks for `excel.exe` as the parent process and a different executable (`ImageFileName`) as the child process.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Detects network communication patterns associated with EtherRAT, including beaconing to 'aurineuroth.com' and CDN-like URLs. Additionally, it identifies host-based fingerprinting activities often performed by EtherRAT, such as hidden PowerShell execution, discovery of MachineGuid, antivirus product information, domain membership, and video controller details, as well as the creation of 'svchost.log' in AppData.
This rule detects PowerShell processes executing commands that involve reading bytes from a .lnk file. This behavior is often associated with malware attempting to extract malicious content embedded within a shortcut file, potentially for further execution or to bypass security controls. The rule specifically looks for `powershell.exe` or `pwsh.exe` in the image filename or original filename, combined with command-line arguments containing both `.lnk` and `readallbytes`.
AI is becoming a key part of detection and response, but it’s important not to overlook simpler techniques that are still effective.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
Detects instances where dllhost.exe, which typically hosts COM objects, spawns suspicious child processes such as command shells, scripting interpreters, or reconnaissance tools. This behavior is highly indicative of COM object hijacking, process injection, or DCOM lateral movement with hands-on-keyboard activity.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
Detects the execution of the specific Linux payload path '/tmp/ld.py', commonly executed via python3 in the background by the dropper associated with the Axios npm supply chain attack.
Detects suspicious command-line arguments used with Windows utilities (LOLBAS), while excluding common legitimate Microsoft/Windows Update URLs.
Page 147 of 191