Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell execution patterns consistent with the Caminho Loader, which uses LSB steganography to extract a payload from a downloaded image file. This rule requires PowerShell Script Block Logging (Event ID 4104).
This rule detects PowerShell scripts attempting to perform keylogging. It specifically looks for the string 'Get-Keystrokes' which is often associated with keylogging scripts, or a combination of 'Get-ProcAddress user32.dll GetAsyncKeyState' and 'Get-ProcAddress user32.dll GetForegroundWindow' which are API calls commonly used in PowerShell keyloggers to capture keyboard input and determine the active window.
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
This rule detects instances where 'powershell.exe', 'pwsh.exe', or 'conhost.exe' are launched by 'explorer.exe' with a command line containing an unusual number of spaces or tabs. This pattern can indicate obfuscation attempts often used by adversaries to hide malicious commands or scripts.
This rule detects LNK (shortcut) files that contain embedded PowerShell commands, specifically looking for the string "powershell" and the argument "-windowstyle hidden". This combination is often used by adversaries to execute malicious PowerShell scripts discreetly, making them less visible to the user.
Detects the invocation of PowerShell commands that reference classes from the "System.Security.Cryptography" namespace. This namespace provides classes for on-the-fly encryption and decryption, which can be abused by adversaries for defense evasion, such as decrypting malicious payloads.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action. This activity can be indicative of an adversary attempting to bypass network controls for C2, lateral movement, or data exfiltration.
This rule detects PowerShell script block logging events that indicate an attempt to establish persistence using Windows Management Instrumentation (WMI) event subscriptions. Specifically, it looks for the creation of WMI event filters (`__EventFilter`) and command-line event consumers (`CommandLineEventConsumer`) within the `root/subscription` namespace, which are common components of WMI persistence techniques.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.
Page 117 of 160