Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
109 detections
Filters
Last updated
All Time
Detection languages
97
5
3
2
1
Contributors
61
35
7
2
2
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
109
Products / Services
54
10
8
3
2
MITRE Techniques
67
65
50
28
20
CVEs
1
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detects suspicious PowerShell download command
Detects Obfuscated use of Environment Variables to execute PowerShell
'The Exchange Powershell Snapin was loaded on a host, this allows for a Exchange server management via PowerShell.
Whilst this is a legitimate administrative tool it is abused by attackers to performs actions on a compromised
Exchange server. Hunt for unusual activity related to this Snapin including it being added on new hosts or by
new accounts.'
Whilst this is a legitimate administrative tool it is abused by attackers to performs actions on a compromised
Exchange server. Hunt for unusual activity related to this Snapin including it being added on new hosts or by
new accounts.'
Detects suspicious PowerShell invocation command parameters
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
This rule detects the loading of the 'Microsoft.ActiveDirectory.Management.dll' DLL via PowerShell's 'Import-Module' or its alias 'ipmo'. This DLL is part of the Active Directory module for PowerShell and is frequently used by attackers to perform Active Directory enumeration, especially in environments where RSAT tools are not installed or administrative privileges are not readily available. The detection focuses on the command line payload containing both the module import command and the specific DLL name.
This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.
Detects the execution of SyncAppvPublishingServer.exe, which can be abused by adversaries to bypass PowerShell execution restrictions. This rule specifically looks for the string 'SyncAppvPublishingServer.exe' within the 'ContextInfo' field of PowerShell module logs, indicating its use in a PowerShell context.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects the creation of new PowerShell module files (.ps or .dll) in the first folder of the module directory structure, specifically within '\WindowsPowerShell\Modules\*\'. This pattern is considered suspicious because legitimate PowerShell modules commonly include a version folder within their directory structure, making direct creation in the module root less common for benign modules.
Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.
Detects the execution of PowerShell scripts obfuscated using techniques associated with Invoke-Obfuscation, specifically when launched via rundll32.exe and shell32.dll. This method is often used by adversaries to evade detection and execute malicious PowerShell code.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Page 4 of 6