Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
184 detections
Filters
Last updated
All Time
Detection languages
71
70
10
8
8
Contributors
47
32
24
15
10
Categories
137
102
96
51
10
Platforms
163
12
11
9
1
Products / Services
49
43
31
17
13
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
1
1
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
3
Detects the execution of PowerShell scripts containing strings associated with the DAYLIGHT obfuscator. This obfuscator is utilized by the Russia-nexus threat group GREYVIBE to hide post-compromise payloads and PhantomRelay implants.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
This rule detects suspicious command-line activity involving several Windows executables (wscript.exe, cscript.exe, wmic.exe, ssh.exe) when combined with specific keywords. It looks for wscript.exe or cscript.exe executing 'SyncAppvPublishingServer.vbs', wmic.exe executing 'process', 'call', or 'create', or ssh.exe using 'ProxyCommand'. Additionally, the rule filters for command lines containing keywords like 'gal', 'i*x', 'gcm', '*stM*', 'jsdelivr.net', 'github', or 'powershell', which are often associated with malicious activity, obfuscation, or external resource loading.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Detects Python one-liners that use base64 decoding functions in command line executions.
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.
Detects execution of "rundll32" with potential obfuscated ordinal calls
Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.
This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.
This behavior has been observed in various malicious lnk files.
This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.
This behavior has been observed in various malicious lnk files.
Faux Elevate Uac Bypass
YARA-L
This rule detects a Faux-Elevate UAC bypass technique. It correlates the launch of auto-elevated processes like 'fodhelper.exe' or 'eventvwr.exe' with the subsequent spawning of suspicious child processes such as 'powershell.exe', 'cmd.exe', or 'wscript.exe'. The detection is further refined by looking for malicious PowerShell patterns within the command line of these child processes, specifically keywords like 'IEX', 'DownloadString', 'Invoke-WebRequest', or '-enc'. Additionally, the rule identifies registry modifications targeting keys related to 'ms-settings\shell\open\command', which is indicative of a registry hijack often used in UAC bypasses.
Detects Node.js or Python processes executing highly obfuscated or large inline expressions via the '-e' (Node.js) or '-c' (Python) flags. This technique is a primary execution method for stagers associated with North Korean APTs, such as DEV#POPPER and OmniStealer, which are often hidden in legitimate-looking configuration files.
Detects the execution of a PowerShell command intended to read the content of the batch script that launched it.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
Detects when explorer.exe modifies a .lnk file immediately after a suspicious process (e.g., LOLBAS) is launched by explorer.exe on the same host. This behavior is a forensic artifact of advanced LNK spoofing techniques (Variants 3 and 4 from the referenced research) where Windows "self-repairs" an internally inconsistent shortcut file after its first execution.
Detects processes launched by Windows Explorer where the command line contains excessive whitespace or hidden control characters. This pattern is indicative of CVE-2025-9491, a technique used to hide malicious arguments from the LNK Properties dialog.
Detects PowerShell commands that use aliases and wildcard matching to dynamically resolve sensitive cmdlets like Invoke-Expression or Invoke-RestMethod. This technique is used to evade static analysis and keyword-based detections and was observed in the Amatera Stealer infection chain.
Power query to find Base64 encoded commands
Detects PowerShell command lines that use repeated, obfuscated string concatenation patterns such as "<str>"+"<str>" "<str>"+"<str>" (or the same with single quotes), which often appear in lightly obfuscated malware or LOLBins.
Often seen in dropper activity related to Clickfix.
Often seen in dropper activity related to Clickfix.
Water Gamayun Group is actively exploiting Windows MMC vulnerability to deliver hidden PowerShell payloads and final malware loaders.
NotDoor is a Outlook Macros to monitor incoming emails for specific triggers, and when the system receives such an email, it executes code paths found in the VBA macro. This allows an attacker to exfiltrate data, upload files, and execute commands on the victim’s computer while using an inconspicuous application as the C2.
Page 5 of 9