Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the execution of "curl.exe" with the "file:///" protocol handler in the command line, which can be used to read local files. This technique can be leveraged by adversaries to exfiltrate or discover sensitive information from a compromised system.
Detects the execution of 'curl.exe' with the '--insecure' flag or its shorthand '-k'. This flag tells curl to proceed with insecure SSL connections and transfers, which can be used by adversaries to bypass certificate validation when communicating with command and control servers or exfiltrating data, especially if they are using self-signed certificates or have intercepted traffic.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
This rule detects the execution of 'VisualUiaVerifyNative.exe', a legitimate Microsoft Windows SDK tool. This executable has been identified as a potential method for bypassing Application Whitelisting (AWL) solutions like Windows Defender Application Control (WDAC) and is included in Microsoft's recommended block rules for such bypasses. Adversaries may abuse this signed binary to proxy execution of malicious code, thereby evading defenses.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
This rule detects the execution of `rundll32.exe` attempting to load `shell32.dll` with the `Control_RunDLL` function, specifically when the DLL is located in suspicious user-writable directories such as `AppData`, `LocalAppData`, `Temp`, or `Users\Public`. This behavior is often indicative of defense evasion techniques used by malware to execute malicious code from non-standard locations.
This rule detects the creation of unusual child processes originating from 'SndVol.exe', which is the legitimate Windows volume mixer. The rule specifically filters out 'rundll32.exe' when it's used with 'shell32.dll,Control_RunDLL', as this is a common and legitimate behavior. Any other child processes spawned by 'SndVol.exe' are considered suspicious and could indicate an attempt to hide malicious activity behind a legitimate process.
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Detects execution of "VSDiagnostics.exe" with the "start" or "launch" command-line arguments to proxy the execution of arbitrary binaries. This technique can be used by adversaries to bypass defenses by leveraging a legitimate, signed Microsoft binary.
Detects calls to the "terminate" function via wmic.exe in order to kill an application. This activity can be used by adversaries to hinder system recovery or disrupt services.
Detects the removal or uninstallation of an application via "Wmic.EXE" using the 'call uninstall' command line arguments. This activity can be indicative of an adversary attempting to remove security software or other applications to hinder defensive capabilities or clean up traces.
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Detects the execution of the built-in "rmdir" command in Windows to delete directories. This activity can be used by adversaries to remove traces of their intrusion activity, such as malware, tools, or other non-native files, to minimize their footprint on a system.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Detects the execution of PowerShell scripts from user-specific AppData directories (Local or Roaming). This behavior is often indicative of malware or adversary activity attempting to evade detection by running scripts from less common or user-writable locations, rather than standard system paths.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Page 307 of 319