Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Detects suspicious process execution patterns originating from AsperaFaspex, specifically targeting activities observed in campaigns attributed to Mint Sandstorm. The rule looks for PowerShell execution with suspicious command-line arguments (e.g., for credential dumping, defense evasion, or discovery), execution of tools like wget or curl for downloading content, attempts to modify local administrator groups, registry modifications for defense evasion, and WMI/vssadmin/wbadmin commands for persistence or defense evasion. This behavior indicates potential post-exploitation activity.
Detects suspicious process execution originating from ManageEngine applications, as observed in attacks attributed to Mint Sandstorm. The rule specifically looks for PowerShell, `lsass` related commands, `wget`, `curl`, script execution, local group modifications, network user additions, registry modifications for Defender or LSA, WMIC for process creation or shadow copy deletion, `vssadmin` for shadow deletion, and `wbadmin` for catalog deletion, all originating from a ManageEngine parent process. It filters out legitimate ManageEngine downloads.
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
Detects potential FileFix attacks where a web browser spawns a suspicious child process (e.g., command prompt, PowerShell, MSHTA) via the file upload dialog's address bar.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Detects the installation of the Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
This rule detects the execution of arbitrary commands via the Windows Subsystem for Linux (WSL) by monitoring process creation events where 'wsl.exe' is the executable. It specifically looks for command lines that include flags like '--exec' or '-e', or common shell commands and downloaders such as 'curl', 'wget', 'bash -c', 'sh -c', 'nc ', or 'ncat '. This activity can indicate an adversary leveraging WSL to execute malicious code or bypass security controls.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
This rule detects instances where 'powershell.exe', 'pwsh.exe', or 'conhost.exe' are launched by 'explorer.exe' with a command line containing an unusual number of spaces or tabs. This pattern can indicate obfuscation attempts often used by adversaries to hide malicious commands or scripts.
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects a suspicious activity chain where an SVG file is created by Outlook, immediately followed by a browser downloading a potentially malicious payload (archive, executable, or script file) on the same device within a short timeframe. This pattern could indicate a social engineering attack where a user is tricked into opening a malicious SVG attachment, which then leads to the download of a secondary malicious file.
Detects the execution of PowerShell, VBScript, PHP, JavaScript, or WSF scripts from the 'AppData\Local\Temp' directory by common Windows processes like explorer.exe or svchost.exe. This behavior can indicate malicious activity where scripts are dropped into temporary locations and then executed.
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the Node Package Manager (npm) or npx spawning child processes commonly used to download remote files. This behavior is often seen in malicious npm packages that use post-install scripts to fetch and execute second-stage payloads, as seen with the AdaptixC2 framework delivery.
Page 125 of 154