Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
125
53
15
13
8
Contributors
42
37
35
15
13
Categories
185
134
79
22
18
Platforms
217
3
2
1
Products / Services
80
57
34
18
12
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
2
2
1
1
Detects the execution of renamed 'cmd', 'powershell', or 'powershell_ise' binaries to 'wermgr.exe'. This technique has been observed in the exploitation of CVE-2023-36874, where attackers disguise legitimate system binaries to evade detection.
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in, which is a common method for privilege escalation and persistence.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution. This rule specifically looks for common scripting and system utilities being launched as child processes of mshta.exe, which is often abused for defense evasion and execution.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Detects various execution patterns of the CrackMapExec pentesting framework
Page 11 of 11