Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects the use of various web request commands and cmdlets within PowerShell script block logs. It specifically looks for common methods used to initiate web requests or file transfers, such as `[System.Net.WebRequest]::create`, `curl`, `Invoke-RestMethod`, `Invoke-WebRequest`, `irm`, `iwr`, `Resume-BitsTransfer`, `Start-BitsTransfer`, `wget`, and `WinHttp.WinHttpRequest`. The rule aims to identify suspicious activity where PowerShell is used to download or interact with remote resources, potentially for ingress tool transfer or command and control. A filter is applied to exclude paths starting with 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\', which are likely legitimate system activities.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Checkpoint Researchers published an Article with a Behavior Analysis of the Pure Malware Family. This Query is based on the Analysis of the Researchers. thx to Checkpoint.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment.
This analytic detects the use of PowerShell commands to add or set exclusions in Windows Defender. It specifically looks for command-line executions containing "Add-MpPreference" or "Set-MpPreference" along with exclusion parameters such as "-Exclusion*", "-ControlledFolderAccessAllowedApplications*", or "-AttackSurfaceReductionOnlyExclusions*". Adversaries commonly use this technique to bypass Windows Defender's protections, allowing malicious code to execute undetected, maintain persistence, and perform further malicious activities without interference from the antivirus.
This rule detects common PowerShell download and execution cradles. It looks for command-line arguments that indicate an attempt to download content from the internet (e.g., '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', 'Invoke-RestMethod', 'irm') combined with immediate execution (e.g., ';iex $', '| IEX', 'Invoke-Expression'). These patterns are frequently used by adversaries to fetch and execute malicious scripts or payloads directly in memory.
The following analytic identifies potential data exfiltration using the PowerShell `net.webclient` command with the `UploadString` method. It leverages PowerShell Script Block Logging to detect instances where this command is executed. This activity is significant as it may indicate an attempt to upload sensitive data, such as desktop screenshots or files, to an external or internal URI, often associated with malware like Winter-Vivern. If confirmed malicious, this could lead to unauthorized data transfer, compromising sensitive information and potentially leading to further exploitation of the compromised host.
The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the `Compress-Archive` command targeting the `Temp` directory. This activity is significant as it may indicate an adversary's attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.
The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. It leverages PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities. This behavior is significant as it may indicate an attempt to exfiltrate sensitive information by capturing desktop screenshots. If confirmed malicious, this activity could allow an attacker to gather visual data from the compromised system, potentially leading to data breaches or further exploitation.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
Winlogon Helper DLL
Sigma
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects a PowerShell command that carves an MSI file from a source file by searching for a specific byte sequence ('UUUU' or 0x55 four times). This novel technique has been used by a Chinese APT group as part of their infection chain, often initiated by a malicious LNK file.
Detects PowerShell commands using `curl -o` to download `.dll`, `.pyc`, or other suspicious file extensions to temporary user directories. This technique was observed being used by the Confucius group to download their malware components.
Detects usage of known PowerShell cmdlets such as "Clear-EventLog", "Remove-EventLog", "Limit-EventLog", "Clear-WinEvent", or direct .NET calls to clear Windows event logs. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects the creation of named pipes by alternate PowerShell hosts, which might be used to bypass detections specifically looking for `powershell.exe`. This rule identifies processes that create named pipes starting with '\PSHost' but are not the standard PowerShell executables or other common legitimate processes that might use such pipes.
Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.
Page 119 of 160