Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Powershell use PassThru option to start in background
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects PowerShell processes executing commands that include base64 decoding (FromBase64String), invoking expressions (IEX), creating web client objects (New-Object Net.WebClient), and making HTTP/HTTPS requests. This combination is often indicative of malicious PowerShell activity, such as downloading and executing payloads from remote servers, potentially obfuscated.
Detects the use of the Add-MpPreference cmdlet to add the root C:\ drive to the Windows Defender exclusion path. Attackers and ransomware families, such as The Gentlemen, use this technique to completely blind Windows Defender to malicious file activity during the encryption process.
This rule detects the execution of PowerShell with encoded commands. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for 'powershell.exe' in the process filename and either '-enc' or '-encodedcommand' in the command line, while excluding known legitimate uses by 'Windows Defender'.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
Detects the use of the Enable-WindowsOptionalFeature cmdlet to reactivate the deprecated and vulnerable SMB1Protocol. Attackers use this to facilitate lateral movement to legacy systems.
This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.
Detects the execution of PowerShell that has been renamed to 'wt.exe', matching the Axios RAT Windows payload behavior. This rule identifies processes masquerading as Windows Terminal (wt.exe) but whose underlying executable is actually PowerShell.
Detects the execution of the Set-MpPreference PowerShell cmdlet to disable Windows Defender real-time monitoring. This technique is frequently abused by malware and ransomware affiliates, such as The Gentlemen RaaS, to bypass endpoint defenses prior to payload detonation.
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
This rule detects the use of PowerShell to re-enable the Server Message Block version 1 (SMB1) protocol on Windows systems. SMB1 is a deprecated and insecure protocol, and its re-enablement often indicates an attempt to support legacy systems or could be exploited by adversaries for lateral movement or data access.
Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.
Detects the use of PowerShell to re-enable the deprecated and vulnerable SMB1 protocol. This protocol is often used by attackers for lateral movement to legacy systems, as highlighted by groups like The Gentlemen RaaS.
Page 105 of 160