Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
125
53
15
13
8
Contributors
42
37
35
15
13
Categories
185
134
79
22
18
Platforms
217
3
2
1
Products / Services
80
57
34
18
12
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
2
2
1
1
LOLBAS shell32
S1QL
This rule detects the execution of `rundll32.exe` with `shell32.dll` that subsequently launches `cmd.exe`. This behavior is often associated with adversaries using `rundll32.exe` as a proxy to execute commands, specifically leveraging `shell32.dll` to invoke `cmd.exe`. The rule includes several exclusions to reduce false positives, such as legitimate `msiexec.exe` parent processes, specific `RunDLL` commands, and `autorun.bat` related activities.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with a file deletion command ('del', 'delete', or 'erase') using the '&' operator. This pattern can indicate an attempt to test network connectivity before or after performing a destructive action, often seen in malware or adversary scripts.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, a technique commonly used for retrieving multi-stage scripts. This behavior was observed in a campaign where curl fetched secondary batch payloads from GitHub repositories into the temp directory.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
Detects potential DCOM lateral movement by identifying svchost.exe spawning DCOM host processes (mmc.exe, mshta.exe, wmic.exe) with the '-Embedding' argument, followed by these DCOM host processes spawning command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern is indicative of adversaries leveraging DCOM for remote code execution and subsequent shell access.
Detects pythonw.exe execution specifically invoked by cmd or powershell from the AppData directory. This behavior is often associated with malicious Python loaders used in social engineering campaigns leveraging AI hype.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging or cleanup operations, often used to execute temporary scripts or hide traces of execution.
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
Detects `cmd.exe` spawned by a Discord-enabled backdoor after command decoding rather than by an interactive user or administrative tool. The rule specifically looks for `cmd.exe` executing commands (`/c`) where the parent process is identified as `searchapp.exe`, `echocreep.exe`, `service.exe`, or `update.exe`.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
This rule detects the creation of common reconnaissance and shell utilities (whoami.exe, hostname.exe, ipconfig.exe, cmd.exe, powershell.exe) by the IIS worker process (w3wp.exe) on Windows systems. This activity is often indicative of a web application compromise, such as a SharePoint vulnerability (e.g., path traversal), where an attacker leverages the web server to execute system commands for discovery or further exploitation. The rule specifically targets Security Event ID 4688 (process creation) and filters for processes spawned by w3wp.exe.
Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.
Detects instances where the headless console host (conhost.exe --headless) is used to launch a command shell. This technique is observed in the EtherRAT MSI loader to execute hidden batch scripts stealthily.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern can indicate an attempt to test network connectivity before performing a destructive action, often seen in malware or adversary scripts.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, commonly used for retrieving multi-stage scripts.
Page 2 of 11