Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Detects PowerShell scripts that perform a multi-stage obfuscation pattern involving the decompression of data using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream', followed by base64 decoding using 'FromBase64String' or 'Convert::FromBase64', and finally loading the resulting payload as a .NET assembly using 'Reflection.Assembly' or 'Assembly]::Load'. This combination of actions is indicative of malware delivery techniques.
Detects PowerShell loading .NET assemblies into memory (not from disk) via reflection from suspicious sources including base64-encoded data, web downloads, or compressed streams. This pattern indicates fileless malware execution or post-exploitation tool delivery.
Detects the use of the 'Add-Type' cmdlet in PowerShell to compile and load C# code directly into memory. This technique is used by the TAMECAT backdoor to pivot from PowerShell to C# modules for tasks like exfiltration and browser data theft, bypassing file-on-disk scanning.
Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects PowerShell scripts attempting to perform image steganography by loading System.Drawing assemblies and calling functions like GetPixel or LockBits to extract data. This technique was observed in an Amatera Stealer campaign where payloads were hidden in PNG files hosted on public CDNs.
Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.
Detects PowerShell processes spawned by Visual Studio Code or Cursor IDEs that use suspicious flags like '-WindowStyle Hidden' and commands typical of download cradles. This behavior is associated with malicious extensions that execute second-stage payloads.
Detects the execution of a hidden PowerShell window that uses Invoke-WebRequest to download and then execute a second-stage PowerShell script. This behavior is characteristic of the IClickFix framework's "ClickFix" social engineering tactic used to deliver malware like NetSupport RAT.
Detects PowerShell commands that use aliases and wildcard matching to dynamically resolve sensitive cmdlets like Invoke-Expression or Invoke-RestMethod. This technique is used to evade static analysis and keyword-based detections and was observed in the Amatera Stealer infection chain.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Power query to find Base64 encoded commands
Detects PowerShell scripts that query the system's total physical memory and compare it against common low-resource thresholds (e.g., < 4GB). This is a known sandbox evasion technique used by malware to identify and avoid analysis environments, which are often configured with limited RAM.
Detects the execution of a PowerShell command that reads a file's byte stream and performs a XOR operation on it. This technique is used by the KONNI APT group to decrypt and execute an embedded payload in memory, as seen in their 2026 campaign involving AI-generated backdoors.
Detects Remcos RAT payloads and commands
Detects the use of PowerShell to add exclusions to Windows Defender. This technique was observed in the PHALT#BLYX campaign where attackers added exclusions for the 'C:\ProgramData' directory and for file extensions like '.exe', '.ps1', and '.proj' to prevent their malware from being detected.
Detects obfuscated PowerShell commands used to disable security features, such as AMSI bypass, disabling TLS certificate validation, and enabling Restricted Admin mode. This behavior is a known TTP of the Qilin ransomware group.
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
Detects a PowerShell process that makes an outbound network connection and contains command-line arguments associated with reflectively loading a .NET assembly from a Base64 encoded string. This is a common fileless technique used by malware like Remcos to execute payloads in memory.
Page 114 of 160