Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
Detects PowerShell downloading and executing remote payloads using invoke-restmethod/irm and invoke-expression/iex. This technique is widely used by ClearFake and PS1Bot malvertising campaigns to execute in-memory payloads directly from C2 servers.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Detects highly obfuscated PowerShell command lines that utilize various encoding and execution techniques, often indicative of malicious activity. The rule scores different obfuscation methods (XOR, Hex, Base64), execution methods (ScriptBlock, IEX), and payload indicators (URLs, download functions). A high total score and specific thresholds for execution and obfuscation trigger the alert. It also considers suspicious parent processes like browsers or scripting hosts.
This rule detects the presence of Remcos RAT by looking for specific strings in memory or files. It identifies a complex PowerShell command used for downloading and executing a base64-encoded payload, which is characteristic of Remcos RAT's infection chain. Additionally, it looks for specific file paths and other PowerShell-related strings often associated with Remcos RAT activity.
Correlates execution of a .pdf.lnk shortcut spawning wscript to run the empty.vbs bridge, followed by a PowerShell process.
Detects PowerShell excluding targeted mining executables and RuntimeHost.exe from Microsoft Defender Antivirus scans. This activity is indicative of cryptojacking campaigns attempting to evade detection.
Detects PowerShell initiating web requests specifically for .jpeg files, a core component of the staging phase of the SilentCanvas operation.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
This rule detects PowerShell processes executing 'Invoke-WebRequest' (IWR) or 'IEX' (Invoke-Expression) commands that establish network connections to the domain 'wigetticks.com'. This combination indicates potential adversary activity involving downloading and executing malicious content from a specific attacker-controlled infrastructure, as identified in the SmartApeSG campaign.
Detects the execution of 'reset.ps1' via PowerShell, which has been identified as the ChainShell deployer script. This activity is associated with the MuddyWater threat group.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects PowerShell iterating directories for known cryptocurrency wallet extensions and associated strings, indicative of PS1Bot malware activity attempting to harvest wallet data.
Detects PS1Bot generating randomly named .lnk files in the Windows Startup folder using PowerShell.
Detects privilege escalation attempts utilizing PowerShell's Start-Process cmdlet with the 'RunAs' verb. This technique can be used by malware like Lucid Stealer's UAC module to elevate privileges.
This detection captures the initial self-infection mechanism of ClickFix campaigns before secondary payloads are downloaded. It identifies PowerShell execution matching the ClickFix clipboard pattern, specifically launching with hidden window styles and executing base64-encoded strings via Invoke-Expression (IEX).
Detects PowerShell running base64 encoded commands
Page 100 of 160