Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Detects activity mentioned in Operation Wocao report
Detects presence of a potentially xor encoded powershell command
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block
This analytic detects processes making DNS queries to tinyurl.com from suspicious file paths. URL shorteners like tinyurl.com are often used by adversaries to hide malicious destinations for phishing, malware distribution, or command and control (C2). While tinyurl.com is a legitimate service, its use by non-browser processes or scripts, especially from locations like AppData, Temp, or ProgramData, is highly suspicious. Further investigation into the process, its execution context, and the resolved domain is recommended to assess intent and risk.
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Detects potential powershell Base64 encoded Shellcode
Detects activity mentioned in Operation Wocao report
Detects all Emotet like process executions that are not covered by the more generic rules
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
Detects potential CommandLine obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects usage of "xor" or "bxor" in combination of a "foreach" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection
Page 70 of 81