Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects the usage of the Windows Package Manager (winget.exe) to install applications via a local manifest file. Adversaries can abuse winget to download and execute various types of payloads (e.g., .exe, .msi, .msix) from remote sources by providing a YAML manifest file directly to the client. This technique can be used for execution and defense evasion.
This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.
Detects possible payload obfuscation via the commandline
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects when a shell process (bash, cmd, or PowerShell) is spawned by a Java executable. This activity can be indicative of exploitation, such as the Log4j vulnerability, where an attacker leverages a Java application to execute arbitrary commands on the underlying system. The rule filters out common CI build agent activities to reduce false positives.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Detects a suspicious PowerShell download cradle that leverages nslookup to extract payloads from DNS TXT records. This technique is often used for defense evasion by adversaries to retrieve malicious code or data over DNS.
This rule detects the execution of the Perl interpreter using the `-e` or `-E` flags. These flags allow for inline execution of Perl code directly from the command line, which can be leveraged by adversaries to launch reverse shells, execute arbitrary commands, or run malicious scripts without needing to write a Perl file to disk. This technique is often used in post-exploitation scenarios for stealthy command execution.
Detects the execution of the PHP interpreter using the "-r" flag, which allows for inline execution of PHP code. This method can be leveraged by adversaries to execute arbitrary PHP code, potentially for launching reverse shells or other malicious activities.
Detects the execution of Python with command-line arguments that indicate an attempt to spawn a pseudo-terminal (TTY). This technique is often used by attackers to gain an interactive shell, especially in compromised environments where direct shell access might be restricted. The rule specifically looks for Python executable names combined with command-line patterns like 'import pty', '.spawn(', or 'from pty import spawn'.
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
Detects the use of "VMwareToolBoxCmd.exe" with the "script" and "set" flags to configure a script to run when a VM state changes. The rule specifically looks for scripts located in suspicious paths like temporary directories or Windows system directories, which could indicate an attempt at persistence or privilege escalation within a virtualized environment.
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
Detects the execution of 'curl.exe' with the '--insecure' flag or its shorthand '-k'. This flag tells curl to proceed with insecure SSL connections and transfers, which can be used by adversaries to bypass certificate validation when communicating with command and control servers or exfiltrating data, especially if they are using self-signed certificates or have intercepted traffic.
This rule detects attempts to change the password for the currently logged-on user using the 'ksetup.exe' utility. The detection specifically looks for the execution of 'ksetup.exe' with the '/ChangePassword' command-line argument. This activity could indicate an attacker attempting to modify user credentials on a compromised system.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command line, which could indicate a suspicious activity. This pattern is often observed in scripts attempting to execute commands via Windows Script Host (WSH) objects.
Detects PowerShell scripts attempting to import modules from suspicious directories such as temporary folders or publicly accessible user directories. This behavior can indicate an attempt to execute malicious code or evade detection by using non-standard module locations.
Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.
Detects the creation of a process named 'rasdial.exe'. This executable is used to establish and manage dial-up network connections, but can also be abused by adversaries for various purposes, including establishing C2 communication or exfiltration channels, or for defense evasion by creating unexpected network connections.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
Page 152 of 154