Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell commands that utilize string normalization obfuscation techniques before Base64 decoding. This rule identifies a generic pattern where one or two placeholder characters are replaced with a literal character, a technique used by malware like SHADOW#REACTOR to bypass static string analysis of the encoded payload.
Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects PowerShell scripts using Windows API calls for parent process ID spoofing, enabling malicious processes to masquerade as legitimate system processes.
Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.
Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
KQL Query from file: Clickfix Win + R Detection
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects a PowerShell process that downloads a ZIP archive and extracts it to the ProgramData directory. This behavior is characteristic of the final stage of the JS#SMUGGLER campaign, which uses this technique to deploy the NetSupport RAT.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects PowerShell execution patterns consistent with the ClickFix malware campaign, which uses obfuscated scripts to decrypt and reflectively load a .NET assembly in memory. This activity is detailed in Stage 2 of the infection chain. The query identifies command lines with combinations of keywords used for decoding, decryption, and in-memory execution, specifically looking for 'FromBase64String' combined with 'Reflection.Assembly' and 'Load' for reflective loading, 'FromBase64String' and '-bxor' for XOR decryption, or 'FromBase64String' and 'Invoke-Expression'/'IEX' for executing decoded scripts in memory.
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects various activities associated with the DRAYN malware family, as described in a detailed analysis. This includes stealthy installation command-line arguments, PowerShell-based system reconnaissance, and modification of file permissions for defense evasion.
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Detects remote command execution via PowerShell's Invoke-Command, a technique used by The Gentlemen ransomware for lateral movement and deploying payloads.
Page 115 of 160