Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
774 detections
Filters
Last updated
All Time
Detection languages
265
259
89
65
35
Contributors
138
116
116
96
88
Categories
545
438
385
116
86
Platforms
767
7
5
3
3
Products / Services
272
264
216
114
62
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
774
CVEs
1
1
1
1
IDS Classtypes
9
3
2
1
IDS Protocols
9
3
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Detects suspicious command-line arguments used with Windows utilities (LOLBAS), while excluding common legitimate Microsoft/Windows Update URLs.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
This rule detects a suspicious sequence of events indicative of the Albabat malware. It looks for instances where a device performs WMI-based reconnaissance (querying CPU, csproduct, OS, or NIC information) followed by or preceded by network communication with either a GitHub repository containing 'billdev' or a Supabase instance. The time window for these events is set to 30 minutes, suggesting a contextual link between the reconnaissance and subsequent network activity.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects abuse of legitimate Windows binaries (LOLBAS) interacting with many others for malicious purposes. Correlation rule
Detects WMI executing script engines as possible persistence mechanism
This rule detects activities associated with the XWorm LATAM campaign. It identifies network indicators such as specific C2 domains (jholycf100.ddns.com.br, voulerlivros.com.br, res.cloudinary.com), a specific IP address (152.249.17.145), and a destination port (7000). It also looks for the abuse of CasPol.exe making outbound connections to the identified C2 infrastructure. Furthermore, the rule detects PowerShell processes spawned by WMI (WmiPrvSE.exe) that attempt to fetch content from Cloudinary and load assemblies in memory, indicating potential in-memory execution. Finally, it includes a specific SHA256 file hash (7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5) associated with the campaign.
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create)
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
Detects a low-noise XWorm execution chain described by ANY.RUN where WmiPrvSE.exe spawns PowerShell that uses WebClient to fetch Cloudinary-hosted content and performs in-memory Assembly.Load.
Detects a Windows Script Host process (wscript.exe or cscript.exe) using WMI to spawn a PowerShell process. This technique is used by malware, such as in the Remcos RAT delivery chain, to break the parent-child process relationship and evade detections based on process ancestry.
The rule detects the execution of PowerShell where the command line includes invoke-CimMethod. This specifically highlights the programmatic invocation of CIM methods, alerting analysts to potential WMI-based attacks or unauthorized administrative actions being performed via script.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects suspicious Windows process execution that may indicate post-exploitation activity, lateral movement, or privilege escalation. This is a generic detection rule for uncommon or high-risk commands and tools.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware like MKDOOR to prevent detection.
SPL Query from file: Defender Exclusion Added via WMIC
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
This rule detects the execution of msiexec.exe with command-line arguments indicating a silent installation (`/q`, `/i`) and the download of an MSI package from a remote HTTP or HTTPS source. The detection specifically looks for this activity when the parent process is cmd.exe, and the grandparent process is java.exe, which is associated with SolarWinds Web Help Desk exploitation (CVE-2025-26399, CVE-2025-40551). This pattern suggests post-exploitation payload delivery via MSI from a compromised Java process.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to add an exclusion (Path, Process, or Extension) to Microsoft Defender. This technique is used by malware, such as the MKDOOR backdoor, to prevent detection by security products.
Page 23 of 37