Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects suspicious command-line activity involving 'cscript' or 'wscript' (Windows Script Host) combined with keywords like 'download', 'execute', or 'powershell'. A high count of such events (3 or more within 5 minutes) from the same computer and account is flagged, indicating potential exploit kit activity, malicious script execution, or initial access attempts.
This rule detects potential indicators of AI-powered adversarial attacks by monitoring process creation events (EventID 4688) for command lines containing keywords related to popular machine learning frameworks (TensorFlow, PyTorch, Keras) combined with terms like 'model', 'neural', or 'train'. A high count (2 or more) of such events within an hour on a single computer and account triggers an alert, suggesting the execution of AI/ML-related code that could be part of an adversarial attack or research.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
This rule detects the execution of processes where the command line contains keywords commonly associated with privilege escalation or gaining administrative privileges, such as 'getadmin' or 'privesc'. It monitors Windows Security Event ID 4688, which logs process creation.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Detects the Intune Management Extension agent spawning command interpreters. Because Intune executes scripts as SYSTEM, monitoring the resulting behavior on the endpoint is critical for identifying malicious script deployments.
Detects process creation where ConfigurationRemotingServer.exe is spawned by winget.exe or WindowsPackageManagerServer.exe. This activity indicates potential WinGet DSC (Desired State Configuration) execution or COM API abuse. Adversaries may leverage WinGet to execute malicious configurations or scripts.
This rule detects activity associated with the GhostLock ransomware by combining three types of signals: file artifact creation/access, specific Python module loads indicative of GhostLock's execution, and the presence of GhostLock-specific command-line arguments. It aims to identify the ransomware across different stages of its operation.
Detects creation of malicious stored procedures in SQL databases
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects instances where curl.exe is used to download payloads from storage.googleapis.com, with the initiating process being a .lnk file. This behavior is characteristic of the PXDropper/10FXRAT LNK campaign.
Detects process execution events containing command-line arguments unique to Chaos ransomware execution, such as 'ignorar_arquivos_grandes' or 'work_mode'. It also includes a more generic detection for 'lkey' and 'path' arguments used together to reduce false positives.
Detects command line execution of 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a remote UNC path, which forces outbound NTLM authentication. This technique can be used by adversaries to capture NTLM hashes.
Page 107 of 154