Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Detects powershell.exe execution from non-standard parent processes or atypical file system locations, a behavior often associated with ClickFix social engineering attacks.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects the use of a PowerShell download cradle, a technique observed in the PhantomCaptcha campaign to download and execute a next-stage payload. This pattern often involves stealthy flags to evade detection.
Detects the use of the AADInternals PowerShell module, a tool used by threat actors like MERCURY and DEV-1084 for credential theft and privilege escalation in Azure AD environments.
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Disable-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to disable scheduled tasks on a compromised system, potentially to remove persistence mechanisms or hinder forensic analysis. The rule specifically looks for a successful HTTP status code (200) and the 'disable-scheduledtask' string, optionally preceded by '-taskname' or '-taskpath'.
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.
Detects PowerShell command clobbering techniques, where a module is installed or imported with the intent to overwrite existing system commands. This can be used in supply chain attacks via repositories like PowerShell Gallery.
This rule detects suspicious, obfuscated PowerShell commands by analyzing the command line for long string literals with low character diversity and high frequency of a single character. It extracts strings enclosed in single quotes, double quotes, or backticks, and then calculates the ratio of distinct characters to total length and the ratio of the most frequent character's count to total length. If these ratios fall below and above certain thresholds, respectively, the command is flagged as suspicious.
Detection based on: https://malwaretech.com/2025/10/exif-smuggling.html
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
Detects Airstalk malware, which exists in both PowerShell and .NET variants. The rule identifies specific strings related to its C2 communication over the AirWatch MDM API, tasking, and other unique artifacts.
Detects token obfuscation techniques commonly used by Invoke-Obfuscation within PowerShell scripts. This rule is designed to identify highly obfuscated PowerShell code that attempts to evade detection by manipulating string formatting, environment variables, and character escaping. It can be used as a threat-hunting baseline to find suspicious scripts in an environment.
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects attempts to disable PowerShell command history logging using 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'. This is a defense evasion technique used by attackers to hide their activities, as seen in the PhantomCaptcha campaign.
Detects the execution of heavily obfuscated PowerShell, characteristic of the MAYBEROBOT backdoor. COLDRIVER uses this script, often via a logon script for persistence, to download and execute further commands. The rule specifically looks for a combination of string replacement functions ('-replace', '\n', ';', '[^\x20-\x7E]') used by MAYBEROBOT for de-obfuscation before execution.
Page 116 of 160