Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,439
11,829
5,873
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
This rule detects the execution of specific PowerShell cmdlets related to Hyper-V virtual machine management. Adversaries may use these cmdlets to create, configure, or start virtual machines to evade detection by isolating malicious activities within a virtualized environment. The rule specifically looks for 'New-VM', 'Set-VMFirmware', and 'Start-VM' within PowerShell script block text.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects the execution of PHP CLI with the "-r" flag to run inline PHP code, specifically looking for calls to the "fsockopen" function. This combination is often used by attackers to create sockets for reverse shell connections, potentially in conjunction with functions like "exec" or "fopen". The rule also checks for common Unix shell names in the command line, indicating an attempt to spawn a shell.
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
This rule detects the use of the PowerShell cmdlet 'Mount-DiskImage' with the '-ImagePath' parameter. Adversaries may use this technique to mount disk image files (like ISO or VHD) containing malicious payloads. This method can bypass Mark-of-the-Web (MOTW) controls, as files extracted or accessed from a mounted image may not inherit the MOTW, allowing them to execute without typical security warnings or protections.
This rule detects the execution of `ruby.exe` with command-line arguments indicative of Evil-WinRM usage. Specifically, it looks for the presence of `-i`, `-u`, and `-p` flags, which are commonly used by Evil-WinRM for specifying the target IP address, username, and password for Windows Remote Management (WinRM) access. This activity suggests an adversary is attempting to establish remote control over a system using a known penetration testing tool.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Detects the usage of the ".Net.Sockets.TCPClient" class within PowerShell, which is commonly abused to establish remote connections and reverse shells. This technique is notably used by tools like Nishang's "Invoke-PowerShellTcpOneLine" and other malicious scripts to create outbound network connections for command and control or data exfiltration.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
This rule detects the execution of PowerShell scripts that directly call a wide range of Windows API (WinAPI) functions. Adversaries often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell cmdlets or .NET methods. The rule specifically looks for a comprehensive list of sensitive WinAPI functions within the script block text, which can indicate various malicious activities such as process injection, privilege escalation, credential access, and memory manipulation. This rule is primarily intended for threat hunting to identify unusual and potentially malicious PowerShell script behavior.
Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity. This rule looks for specific patterns in the command line arguments that indicate an attempt to establish a reverse shell using Perl's networking capabilities.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects the execution of the `Get-ADReplAccount` cmdlet from the DSInternals PowerShell module with specific parameters (`-All` and `-Server`). This cmdlet is used to perform a DCSync attack, which allows an attacker to retrieve password hashes and other sensitive Active Directory information by simulating a domain controller replication. The DSInternals module provides advanced capabilities for Active Directory manipulation and auditing, and its use in this manner is highly suspicious and indicative of credential access attempts.
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
Page 182 of 191