Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe". These interpreters can be used by adversaries for application whitelisting bypass and to execute F# code via scripts or inline, potentially for malicious purposes.
Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Detects the execution of PowerShell scripts via 'Runscripthelper.exe' when the command line contains 'surfacecheck'. This behavior is suspicious as 'Runscripthelper.exe' is a legitimate Windows binary that can be abused for indirect command execution, often as part of Living Off The Land Binaries and Scripts (LOLBAS) techniques.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
This rule detects the execution of `fsutil.exe` with specific command-line arguments to set `SymlinkEvaluation`. This action can be used by adversaries, such as ransomware, to enable symbolic link following, potentially allowing them to access and encrypt files through shortcuts or junctions that would otherwise be inaccessible.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects the execution of 'OpenConsole.exe' when it is not launched from the legitimate Windows Terminal path. This behavior is often indicative of an adversary attempting to use 'OpenConsole.exe' as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting and execute other binaries.
Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.
This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.
This rule detects the execution of "VMwareToolBoxCmd.exe" with specific command-line arguments ("script" and "set") that indicate an attempt to configure a script to run when a virtual machine changes state. This technique can be used by adversaries to establish persistence within a virtualized environment.
Detects the usage of winget to add new additional download sources. Adversaries may abuse this functionality to introduce malicious package repositories, potentially leading to the download and execution of unauthorized software or tools.
Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Page 151 of 154