Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Page 72 of 81