Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Detects PowerShell calling a credential prompt
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
MERCURY APT Activity
Sigma
Detects suspicious command line patterns seen being used by MERCURY APT
Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
The following analytic detects potentially suspicious file copy operations targeting the System32 or SysWow64 directories as source, often indicative of malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on activity initiated by command-line tools like cmd.exe or PowerShell. This behavior is significant as it may indicate an attempt to evade defenses by copying an existing binary from the system directory and renaming it. If confirmed malicious, this activity could allow an attacker to execute code undetected and potentially leading to system compromise or further lateral movement within the network.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads
that often undergo minimal changes by attackers due to bad opsec.
Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads
that often undergo minimal changes by attackers due to bad opsec.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
Page 176 of 213