Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects PowerShell being executed with execution policy bypass and hidden window styles. This specific combination, particularly with the '-f' parameter, was utilized by the empty.vbs script to launch Profile.ps1 in the Dragon Weave campaign.
Detects PowerShell execution initiated by 'MicrosoftSystem64.exe' or 'MicrosoftSystem64' with specific command-line arguments (-NoProfile, -NonInteractive, -Command). This activity is indicative of the Node.js SEA RAT malware, associated with the DPRK-linked actor FAMOUS CHOLLIMA, attempting remote command execution.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects the execution of specific function names commonly associated with the WinPEAS PowerShell enumeration script, often used by adversaries to find privilege escalation paths.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Identifies PowerShell executing scripts or expressions from the ProgramData directory, which may indicate malicious staging or backdoor execution. This rule specifically looks for PowerShell processes where the command line includes 'C:\ProgramData\' and also contains keywords like 'IEX', 'Invoke-Expression', or '.ps1', suggesting the execution of a script or expression.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
Identifies wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags, indicative of potential MonoGlyphRAT staging activity.
Detects PowerShell scripts attempting to download and execute the official Deno installation script. This behavior is abused by threat actors, such as the operators behind the DinDoor backdoor, to silently prepare an endpoint for fileless JavaScript malware execution.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects PowerShell script block telemetry (Event ID 4104) containing P/Invoke declarations targeting advapi32.dll's CredEnumerate function or related Credential Manager APIs (CredRead, CredWrite). This technique bypasses standard cmdlets that may be monitored or restricted, providing direct API access to stored Windows credentials including RDP sessions, web service credentials, and enterprise application tokens. Generalizes well beyond specific campaigns to most PowerShell credential-theft families.
Page 103 of 160