Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below
Detects base64 encoded listing Win32_Shadowcopy
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects potential powershell Base64 encoded Shellcode
Detects the execution patterns of the KimJongRAT PE or PowerShell variant loaders, specifically rundll32 executing a DLL from AppData\Local with export 's' or powershell executing '1.ps1' from AppData\Local with '1.log' as an argument.
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations
Detects base64 encoded .NET reflective loading of Assembly
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects the PowerShell command lines with special characters
Detects potential commandline obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Detects the PowerShell command lines with special characters
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Detects the execution of certutil with certain flags that allow the utility to download files.
Detects Obfuscated Powershell via Stdin in Scripts
Page 68 of 81