Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,670
9,758
6,693
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Detects the use of 'pushd' via cmd.exe, powershell.exe, or pwsh.exe to mount remote UNC or WebDAV paths. This command allows users to map a network share to a temporary drive letter and change the current working directory, which is frequently used by adversaries to access remote shares or stage tools.
Detects indicators of Remcos RAT activity, specifically focusing on its use of native Windows utilities like attrib.exe, icacls.exe, and cmd.exe to modify file attributes, alter access control lists, or facilitate self-deletion. The rule also triggers when a identified Remcos-related process directly spawns these administrative tools for evasive actions.
Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects a potential exploitation of CVE-2026-12957, where a malicious git repository contains an MCP (Model Context Protocol) configuration file. When this workspace is opened, the Amazon Q Developer extension for VS Code improperly processes this configuration, resulting in the unauthorized execution of shell processes (cmd.exe, powershell.exe, bash, or sh) by the extension's host processes (code.exe or node.exe).
Detects the use of the Windows 'netsh.exe' utility to perform network port proxying or tracing configurations, initiated by common command-line shells (cmd.exe, powershell.exe). Attackers may use these capabilities for lateral movement, persistence, or to sniff network traffic.
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.
Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects the execution of common Windows system utilities (tasklist.exe, sc.exe, reg.exe, wmic.exe, powershell.exe) with command-line arguments indicative of security software, antivirus product, or system service enumeration. This activity is frequently associated with reconnaissance efforts by threat actors attempting to identify defensive capabilities.
Detects instances where the Visual Studio Code process (code.exe) spawns shell or scripting interpreters (such as cmd.exe, powershell.exe, python.exe, etc.) to execute commands involving sensitive file paths, development configuration files, or suspicious keywords, specifically within a short duration (5 minutes) after Git or NPM activity has occurred on the same host. This pattern may indicate exploitation or unauthorized code execution triggered through a compromised or malicious development environment.
Detects suspicious process execution patterns related to WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe, which can be abused for command execution or bypassing standard interaction via COM interfaces. This includes spawning the package manager server from unauthorized parent processes, the use of manual activation flags for COM abuse, and the spawning of shell or utility processes from the configuration remoting server.
Detects anomalous execution patterns of the Windows Package Manager (WinGet) DSC engine. It monitors for potential bypass of the standard winget.exe client by identifying direct calls to WindowsPackageManagerServer.exe with manual activation flags, unusual parentage of ConfigurationRemotingServer.exe, or usage of DSCourier-related binaries that interact with WinGet components, which may indicate unauthorized package installation or configuration management.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects the execution of RDP files (mstsc.exe) initiated by common application vectors (email clients, browsers, archive utilities) from suspicious user-writable paths like Temp, Downloads, or AppData directories. This behavior is consistent with Turla group's phishing delivery chain where malicious RDP files are used for persistence or lateral movement.
Page 16 of 29