Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
29
Contributors
18
11
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
29
Products / Services
16
1
MITRE Techniques
23
23
10
4
4
Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.
This technique is often abused by attackers to download additional payloads.
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects PowerShell called from an executable by the version mismatch method
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Detects remote PowerShell sessions
Detects suspicious PowerShell download command
Shadow Copies deletion using operating systems utilities via PowerShell
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects PowerShell called from an executable by the version mismatch method
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects powershell execution with that make use of to the bxor (Bitwise XOR).
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.
Detects a renamed PowerShell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths. The rule specifically looks for PowerShell classic logs where the 'HostName' is 'ConsoleHost' but the 'HostApplication' field does not contain typical PowerShell executable paths or names, indicating a potential renaming or masquerading attempt.
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Page 1 of 2