Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
Detects PowerShell commands attempting to retrieve the installed UI culture name. This specific technique is utilized by the EtherRAT SYS_INFO module to check the system's locale and selectively self-destruct on CIS-region machines.
Detects the Faux-Elevate UAC bypass technique where auto-elevated binaries (fodhelper.exe, eventvwr.exe) are abused to launch suspicious child processes like PowerShell or cmd.exe. The detection logic further correlates this with registry modifications related to UAC bypass (specifically 'Software\Classes\ms-settings\shell\open\command') and subsequent outbound network activity to retrieve payloads, indicating a full chain of execution and C2 communication.
Detects PowerShell processes executing commands that combine `Invoke-Expression` (iex) and `Invoke-RestMethod` (irm) with an HTTP or HTTPS URL. This combination is often used by adversaries to download and execute malicious scripts or payloads directly from the internet, without writing them to disk. The rule includes exclusions for known legitimate installers like the UV installer launched by trusted processes.
Detects PowerShell script blocks loading the WinRT ToastNotificationManager API or using the ContentType=WindowsRuntime type accelerator syntax. Used by attackers to programmatically send fake toast notifications impersonating legitimate applications such as Microsoft Edge, Teams, or Windows Security.
Detects PowerShell script blocks containing the scenario="incomingCall" XML attribute, which triggers Windows' special incoming call notification UI with accept/dismiss buttons and an avatar image loaded from an attacker-controlled URL. Sourced from the toastnotify-bof repository incoming-call.xml example payload. Near-zero legitimate enterprise use of this attribute in PowerShell.
Detects PowerShell constructing toast notification XML with an external HTTP image URL alongside WinRT toast API calls. When the notification is displayed the notification platform fetches the image, creating an outbound connection to an attacker-controlled server for delivery confirmation. Sourced from the toastnotify-bof repository incoming-call.xml and teams-security-alert.xml example payloads.
Detects Invoke-CredentialPhisher (legacy tool) or the sendtoast keyword in PowerShell script blocks. Both are direct indicators of an active toast notification-based credential phishing operation in progress.
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects PowerShell constructing toast notification XML containing an activationType attribute combined with a protocol scheme. This pattern creates a clickable notification button that launches a URI handler, the primary mechanism for delivering phishing links via toast notifications. Covers both msteams:// protocol links and generic protocol handlers.
Detects PowerShell enumerating Application User Model IDs via the notification settings registry hive, the Get-StartApps cmdlet, or the System.AppUserModel.ID extended property on .lnk shortcuts. Attackers use these to discover trusted AUMIDs to impersonate in fake toast notifications.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects the execution of PowerShell or VBScript scripts matching the naming conventions "Romeo*.ps1" or "Juliet*.vbs". These scripts are utilized as initial triggers for a stealthy Deno-based in-memory loader, a technique recently observed in LeakNet ransomware campaigns following initial access.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects suspicious PowerShell execution patterns commonly associated with the ClickFix initial access technique, where a user is tricked into pasting and executing a malicious script.
Detects the C2 communication of the Slopoly PowerShell backdoor, used by the Hive0163 group. It looks for specific HTTP POST requests containing a JSON body with characteristic keys.
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects WMI abuse for lateral movement, remote execution, and persistence.
Using native WMI, and one condition for PowerShell plus WMI queries
Using native WMI, and one condition for PowerShell plus WMI queries
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
Page 110 of 160