Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
184 detections
Filters
Last updated
All Time
Detection languages
71
70
10
8
8
Contributors
47
32
24
15
10
Categories
137
102
96
51
10
Platforms
163
12
11
9
1
Products / Services
49
43
31
17
13
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
3
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.
This rule detects the execution of PowerShell or pwsh.exe with an encoded command. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for the '-EncodedCommand' or '-enc' parameter followed by a base64-encoded string of at least 20 characters.
AI-powered phishing-as-a-service abusing device-code authentication
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
This rule detects attempts to inject shell metacharacters or command substitution into JSON associated with a 'start vnc' operation within FortiSandbox. It specifically looks for patterns indicative of command injection vulnerabilities in network events, either in the event_sub_type or action_remote_ip fields. The rule aims to identify malicious activity targeting FortiSandbox, potentially leveraging a vulnerability like the one described in FG-IR-26-141.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects execution of PowerShell with encoded commands, often used in malicious scripts.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Detects PowerShell running base64 encoded commands
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
This rule detects HTTP requests where the URI contains the string "%comspec%" (case-insensitive). This pattern is often used by attackers to obfuscate command execution, specifically by referencing the command interpreter (cmd.exe) via an environment variable, as part of defense evasion tactics. The rule is specifically looking for this string within the URI of an HTTP request flowing from the internal network to an external server.
This rule detects character substitution obfuscation in web requests, specifically looking for three or more consecutive occurrences of URL-encoded characters that represent common path or null byte characters (e.g., '%5C' for '\', '%2F' for '/', '%00' for null, '%0A' for newline, '%0D' for carriage return). This pattern is often used by attackers to bypass security filters or to obscure malicious payloads in HTTP URIs.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Page 4 of 9