Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,636 detections
Filters
Last updated
All Time
Detection languages
6,581
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,459
6,773
3,297
2,511
1,598
Platforms
13,080
2,270
1,179
493
256
Products / Services
3,812
3,376
1,976
1,254
704
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
This rule detects suspicious command-line activity involving 'cscript' or 'wscript' (Windows Script Host) combined with keywords like 'download', 'execute', or 'powershell'. A high count of such events (3 or more within 5 minutes) from the same computer and account is flagged, indicating potential exploit kit activity, malicious script execution, or initial access attempts.
This rule detects potential indicators of AI-powered adversarial attacks by monitoring process creation events (EventID 4688) for command lines containing keywords related to popular machine learning frameworks (TensorFlow, PyTorch, Keras) combined with terms like 'model', 'neural', or 'train'. A high count (2 or more) of such events within an hour on a single computer and account triggers an alert, suggesting the execution of AI/ML-related code that could be part of an adversarial attack or research.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
This rule detects the execution of processes where the command line contains keywords commonly associated with privilege escalation or gaining administrative privileges, such as 'getadmin' or 'privesc'. It monitors Windows Security Event ID 4688, which logs process creation.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Page 471 of 745