Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.
This rule detects the execution of the PingCastle utility, a legitimate Active Directory security assessment tool, when its executable name has been changed. Adversaries often rename legitimate tools to evade detection. The detection logic relies on identifying specific original file names within the PE metadata (OriginalFileName) and/or recognizing characteristic command-line arguments used by PingCastle, such as those related to scanner functions or health checks. The rule specifically filters out executions where the image path matches the original PingCastle executable names, focusing on instances where the binary has been renamed.
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands, as observed in the Raspberry Robin attack. This rule specifically looks for 'ShellExec_RunDLL' in the command line combined with suspicious paths or commands like 'Desktop', 'Temp', 'Users\Public', 'comspec', 'iex', 'Invoke-', 'msiexec', 'odbcconf', or 'regsvr32'.
Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Detects the use of rar.exe to create an archive with a password and recursive flag, specifically targeting system folders or common staging directories. This behavior is often associated with attackers collecting and preparing data for exfiltration.
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
This rule detects instances where 'cmd.exe' is spawned by a parent process that is considered unusual or suspicious. The rule specifically lists a set of parent processes that are generally not expected to launch 'cmd.exe' in a typical operating environment. This could indicate malicious activity such as an attacker attempting to execute commands via a compromised legitimate process or a process that has been hijacked.
Detects the creation of specific files within the SysAidServer Tomcat webapps directory, which are indicators associated with the Lace Tempest threat group (also known as FIN7). The rule looks for specific filenames and suffixes that have been observed in attacks involving PowerShell scripts by this group.
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
This rule detects the usage of the Windows Package Manager (winget.exe) to add new package sources, specifically looking for command-line arguments that include 'source add' and an IP address as the source. This could indicate an attempt to introduce a malicious or untrusted package repository.
Detects suspicious parent process for cmd.exe
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Detects the redirection of discovery command output by the Ursnif malware. Specifically, it looks for `cmd.exe` processes spawned by `explorer.exe` that execute a command with `/C ` and redirect its output to a `.bin` file in the `AppData\local\temp\` directory.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of "csc.exe" by the "w3wp.exe" process, specifically looking for patterns indicative of the MOVEit Transfer CVE-2023-34362 exploitation. This activity is associated with dynamic compilation of malicious DLL files within the .NET framework temporary ASP.NET files directory.
Page 147 of 154