Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects suspicious execution of 'sysprep.exe' where the command line includes a path within the 'AppData' folder. This behavior has been observed in malware like Trojan Syndicasec, as detailed in Symantec's Thrip report.
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
This rule detects the execution of PowerShell scripts where the script content is provided via a redirected input stream. This technique is often used by adversaries to execute malicious PowerShell code without writing it to a file, which can help evade detection. The rule specifically looks for PowerShell or pwsh executables being run with a command line containing '- <', which signifies input stream redirection.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Detects java process spawning suspicious children
Detects usage of "xterm" as a potential reverse shell tunnel
Detects triggering of AMSI by Windows Defender.
Detects processes creating temp files related to PCRE.NET package
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Detects processes loading modules related to PCRE.NET package
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Detects process activity patterns as seen being used by Sliver C2 framework implants
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Identifies when a new cloudshell is created inside of Azure portal.
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Detects possible payload obfuscation via the commandline
Detects potential process patterns related to Cobalt Strike beacon activity
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Page 153 of 154