Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
Detects PowerShell script executions that contain common cmdlets and classes used for downloading external payloads. This rule specifically looks for `Invoke-WebRequest`, `Invoke-RestMethod`, `DownloadString`, `DownloadFile`, `Net.WebClient`, and `Start-BitsTransfer` within PowerShell command lines, focusing on scripts executed from files.
Identifies PowerShell executing a script block directly from the specific environment variable 'INTERNAL_DB_CACHE', as observed in the Evil MSI Background steganography campaign. This technique is used to hide malicious PowerShell code within an environment variable and execute it, bypassing direct script file detection.
Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects PowerShell command obfuscation techniques used to evade detection
This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.
Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.
Detects privilege escalation attempts utilizing PowerShell's Start-Process cmdlet with the 'RunAs' verb. This technique can be used by malware like Lucid Stealer's UAC module to elevate privileges.
This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Page 101 of 160