Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
Detects a PowerShell process reading the content of a batch script named 'rEgX.cmd' to extract an appended payload. This technique is used by the DeadVax malware as part of its stage 3 execution.
Detects the creation of scheduled tasks with specific names and command-line patterns associated with the BadPaw PowerShell backdoor. This technique is used by the threat actor to establish persistence on the compromised system.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects PowerShell attempting to read a specific batch file named 'rEgX.cmd' using Get-Content, a signature behavior of the Dead#Vax self-parsing loader. This technique is used to extract a hidden payload from the script itself.
Detects instances where PowerShell is used to read the contents of a batch file (specifically looking for '.cmd' or '.bat' extensions) to extract a payload. This logic focuses on the 'Get-Content' cmdlet being applied to a script file, which is a key component of the campaign's self-parsing and payload extraction mechanism, as seen in the Dead#Vax campaign.
Detects the execution of a PowerShell command intended to read the content of the batch script that launched it.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
Detects a PowerShell command used to read its own batch script container (e.g., rEgX.cmd) to find and extract a hidden, encoded payload. This self-parsing technique is a core feature of the Dead#Vax malware.
Detects a specific PowerShell command pattern used by the DeadVax malware campaign. The malware uses a self-parsing technique to read its own batch script file and extract a hidden, encoded payload from lines starting with an '@' character.
Detects a PowerShell script attempting to read the content of a command or batch file (.cmd) to extract a payload. This technique was observed in the DeadVax campaign where a batch script invokes PowerShell to parse its own content, looking for a line starting with '@' which contains the next stage's Base64-encoded payload.
Detects a PowerShell process reading its own or another script's content to extract a hidden payload. This technique was observed in the Dead#Vax campaign to deobfuscate and execute payloads stored within the script file itself.
Detects PowerShell commands checking for low system memory (specifically less than 3GB), a common anti-sandbox technique used by the DeadVax campaign to evade analysis environments.
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects the execution of PowerShell with a command line containing a specific sequence of strings associated with extracting and executing malware from a ZIP file, as observed in the Steam_Monitor campaign. This typically involves using PowerShell commands like 'Get-ChildItem', '::OpenRead', and 'TaR' in conjunction with a '.zip' file.
Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
Detects a PowerShell command pattern commonly used by the IClickFix framework. This involves using a hidden window to download a script (often .ps1 or .json) and execute it, bypassing the execution policy. This is a common technique following a "ClickFix" social engineering lure.
Page 111 of 160