Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as Base64 encoding is often used by attackers to obfuscate malicious payloads, making it harder to detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system.
The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.
Detects the execution of the DInjector PowerShell cradle, identified by specific command-line arguments '/am51' and '/password'. This tool is often used for process injection and privilege escalation.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
Detects PowerShell command-line execution with unusual or randomized character casing for keywords like "powershell" or "-noprofile". This is a common obfuscation technique used by attackers to evade basic, case-sensitive detections. This rule is inspired by the THOR PowerShell_Case_Anomaly Yara rule.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
This rule detects the use of 'Set-Alias' or 'New-Alias' cmdlets in PowerShell script block logs. Adversaries often use these cmdlets to create aliases for legitimate or malicious commands, thereby obfuscating their activities and making detection more difficult. The rule includes a filter for common, legitimate CIM session-related aliases to reduce false positives.
The analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
The following analytic detects the use of `powershell.exe` to query the domain for Service Principal Names (SPNs) using Script Block Logging EventCode 4104. It identifies the use of the KerberosRequestorSecurityToken class within the script block, which is equivalent to using setspn.exe. This activity is significant as it often precedes kerberoasting or silver ticket attacks, which can lead to credential theft. If confirmed malicious, attackers could leverage this information to escalate privileges or persist within the environment.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects PowerShell execution patterns associated with the "Cache Smuggling" technique. This involves copying browser cache files, searching them with regex for an embedded payload, and then writing and executing that payload. This specific variant was observed being launched by conhost.exe in headless mode to conceal the window.
Detects PowerShell scripts leveraging System.Drawing and System.Windows.Forms to manipulate Metafile objects. This technique can be used to trigger a denial-of-service vulnerability (related to CVE-2025-53766) in the Windows GDI component by processing a specially crafted metafile.
The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
The analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving `system.net.webclient` and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.
This analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. This pattern is often indicative of obfuscated scripts or those attempting to download secondary payloads. Such activity may signal an attempt to execute malicious code, download additional malware, lead to further system compromise, or data exfiltration. Review parallel processes and the full script block for additional context and related artifacts.
The analytic detects the use of `GetProcAddress` within PowerShell script blocks, captured via PowerShell Script Block Logging (EventCode=4104). The presence of `GetProcAddress` in PowerShell is often indicative of malicious activity, such as process injection or other code execution techniques, as it allows for dynamic resolution of API functions. This behavior is unusual for legitimate PowerShell scripts and suggests an attacker is attempting to execute arbitrary code, potentially leading to system compromise. Analysts should investigate the full script block and any associated processes.
Detects PowerShell processes executing commands that utilize `Net.WebClient` to download content, indicated by the presence of `new-object`, `net.webclient).`, and `download` keywords in the command line, along with either `string(` or `file(`. This pattern is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the use of various command-line tools and PowerShell cmdlets that can initiate web requests. These include native Windows PowerShell cmdlets like 'Invoke-RestMethod', 'Invoke-WebRequest', 'Resume-BitsTransfer', 'Start-BitsTransfer', and their aliases ('irm', 'iwr'), as well as common command-line utilities like 'curl' and 'wget', and .NET framework calls such as '[System.Net.WebRequest]::create' and 'WinHttp.WinHttpRequest'. Adversaries often use these methods to download additional tools, malware, or exfiltrate data from a compromised system.
Page 118 of 160