Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
Just reading about a fake Boeing RFQ was enough to trigger a full attack chain — starting from a DOCX and moving through RTF, JavaScript, PowerShell and even a full Python runtime, ending with Cobalt Strike running in memory.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Detects PowerShell being copied and renamed to 'wt.exe' in the ProgramData directory, initiated by cmd.exe, powershell.exe, or pwsh.exe, and executing a command line containing '-curl'. This behavior has been documented in the Axios npm supply chain attack.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects the initial CTRL execution chain where a malicious LNK launches hidden PowerShell, writes ms-settings UAC bypass registry keys including DelegateExecute, then starts fodhelper.exe. This rule correlates process events for PowerShell executing with a hidden window style and obfuscated commands, registry modifications to the ms-settings UAC bypass key, and the subsequent execution of fodhelper.exe.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Detects network communication patterns associated with EtherRAT, including beaconing to 'aurineuroth.com' and CDN-like URLs. Additionally, it identifies host-based fingerprinting activities often performed by EtherRAT, such as hidden PowerShell execution, discovery of MachineGuid, antivirus product information, domain membership, and video controller details, as well as the creation of 'svchost.log' in AppData.
This rule detects PowerShell processes executing commands that involve reading bytes from a .lnk file. This behavior is often associated with malware attempting to extract malicious content embedded within a shortcut file, potentially for further execution or to bypass security controls. The rule specifically looks for `powershell.exe` or `pwsh.exe` in the image filename or original filename, combined with command-line arguments containing both `.lnk` and `readallbytes`.
AI is becoming a key part of detection and response, but it’s important not to overlook simpler techniques that are still effective.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
This rule detects PowerShell commands that are used to enumerate locale-related system information. Specifically, it looks for PowerShell or pwsh.exe processes executing commands containing keywords like 'InstalledUICulture', 'Get-UICulture', 'CurrentUICulture', 'CurrentThread.CurrentUICulture', 'DefaultThreadCurrentUICulture', 'OSLanguage', or 'MUILanguages'. This activity can be indicative of an adversary attempting to gather system configuration details, potentially for environmental awareness or to tailor subsequent actions.
Faux Elevate Uac Bypass
YARA-L
This rule detects a Faux-Elevate UAC bypass technique. It correlates the launch of auto-elevated processes like 'fodhelper.exe' or 'eventvwr.exe' with the subsequent spawning of suspicious child processes such as 'powershell.exe', 'cmd.exe', or 'wscript.exe'. The detection is further refined by looking for malicious PowerShell patterns within the command line of these child processes, specifically keywords like 'IEX', 'DownloadString', 'Invoke-WebRequest', or '-enc'. Additionally, the rule identifies registry modifications targeting keys related to 'ms-settings\shell\open\command', which is indicative of a registry hijack often used in UAC bypasses.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
Page 109 of 160