Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of the Microsoft HTML Application host (mshta.exe) when it is used to launch scripts from remote URLs (http/https/ftp) or when it spawns common command-line shells and scripting engines, which is a common indicator of living-off-the-land techniques used to execute malicious payloads.
Detects the execution of PowerShell commands that leverage obfuscation or evasion techniques such as Base64 encoded commands, hidden window styles, in-memory script downloads via IEX, and common string obfuscation methods like backtick insertion, character concatenation, and casting. These techniques are frequently used by adversaries to bypass command-line monitoring and execute malicious payloads.
This rule detects PowerShell processes (including pwsh and ISE) referencing Anti-Malware Scan Interface (AMSI) related classes and methods in their command line arguments. This is a common indicator of an attempt to interact with or manipulate AMSI, often used to bypass or disable security scanning during the execution of malicious scripts.
Detects instances where the WMI service (wmiprvse.exe) spawns common command-line or system tools such as cmd.exe, powershell.exe, or rundll32.exe. This behavior is often indicative of lateral movement or remote command execution via WMI.
Detects common suspicious PowerShell command-line patterns often used for malicious purposes, including base64-encoded command execution, hidden-window execution with common evasion flags, and the use of download/execution cmdlets for in-memory payload delivery.
Detects the modification of Windows Run or RunOnce registry keys to execute applications from suspicious paths (e.g., Temp, AppData) or trigger PowerShell commands that contain suspicious arguments or patterns, indicating potential persistence mechanisms.
Detects suspicious PowerShell ScriptBlock logs (Event ID 4104) that attempt to bypass security features like AMSI or ETW while employing common obfuscation techniques such as Base64 encoding, reflection, or character concatenation.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects anomalous execution of PowerShell commands spawned by processes identified as 'javaw.exe' or 'GlobalTellurSync.exe' (associated with DragonForce backdoor activity). The detection focuses on instances where these processes launch from non-standard user-writable directories (e.g., AppData, Temp) and execute PowerShell commands that contain obfuscated arguments or payloads, while excluding standard scheduled task invocations.
Detects anomalous execution of PowerShell commands spawned by processes identified as 'javaw.exe' or 'GlobalTellurSync.exe' (associated with DragonForce backdoor activity). The detection focuses on instances where these processes launch from non-standard user-writable directories (e.g., AppData, Temp) and execute PowerShell commands that contain obfuscated arguments or payloads, while excluding standard scheduled task invocations.
Detects instances where a legitimate Remote Monitoring and Management (RMM) agent (MSP360 or Faronics) is used to execute PowerShell commands that silently install ScreenConnect (ConnectWise Control) MSI packages within a 10-minute window. This behavior is indicative of an adversary abusing administrative tools for lateral movement or persistence.
Detects instances where a legitimate Remote Monitoring and Management (RMM) agent (MSP360 or Faronics) is used to execute PowerShell commands that silently install ScreenConnect (ConnectWise Control) MSI packages within a 10-minute window. This behavior is indicative of an adversary abusing administrative tools for lateral movement or persistence.
Detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious command-line patterns, specifically tasks pointing to potentially volatile directories (temp, appdata, programdata) or tasks executing PowerShell/CMD with common obfuscation/execution arguments such as encoded commands, hidden window styles, or base64 decoding.
Detects the execution of PowerShell processes using suspicious command-line flags, encoding, or built-in .NET network download methods (e.g., IEX, Net.WebClient, DownloadString). The rule excludes signed PowerShell binaries and common system management tools like SCCM or monitoring agents to reduce false positives.
Detects the suspicious retrieval and immediate execution of Agentic AI configuration files (e.g., AGENTS.md, KNOWLEDGE.md) from remote sources using common command-line utilities. This pattern is indicative of an adversary injecting malicious agent instructions or unauthorized configurations into an AI environment.
Detects anomalous, high-volume HTTP requests to AI agent orchestration endpoints (e.g., tool invocation, plugins, or webhooks) followed by suspicious process execution or outbound network connections from the same host. This behavior is indicative of RCE exploitation against an AI agent framework, such as insecure deserialization or SSRF within a plugin connector.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the execution of the GigaWiper malware or the use of common system commands associated with destructive data activities, such as recursive file removal, disk formatting, or secure data overwriting, often used by threat actors for extortion.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
Page 12 of 213