Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects attempts to change the PowerShell script execution policy to a less secure level (Bypass or Unrestricted) using the '-ExecutionPolicy' flag. This can be abused by adversaries to execute unsigned or malicious scripts.
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.
This rule detects PowerShell or pwsh.exe process creations that include command-line arguments indicative of image file manipulation and obfuscation techniques. Specifically, it looks for the presence of image file extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif) combined with PowerShell commands or .NET methods related to base64 decoding, expression invocation, command invocation, GDI+ graphics operations (System.Drawing, Bitmap, GetPixel, SetPixel, LockBits, UnlockBits, PixelFormat), or file content reading ([IO.File]::ReadAllBytes, Get-Content). Additionally, it checks for common obfuscation or execution flags such as '-enc', '-encoded', '-e', '-w hidden', '-windowstyle hidden', '-nop', '-noprofile', '-ep bypass', or '-executionpolicy bypass'. This combination suggests an attempt to execute malicious code hidden within image files, often using steganography or other covert methods.
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
Detects the execution of an encoded PowerShell command where the parent process is w3wp.exe. This behavior is often indicative of an attacker leveraging a compromised web server (IIS) to execute malicious PowerShell scripts, potentially for further reconnaissance, privilege escalation, or payload delivery. The rule includes exclusions for known legitimate PowerShell scripts to reduce false positives.
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Detects the use of PowerShell cmdlets (`Get-LocalGroup`, `Get-LocalGroupMember`) or WMI queries (`Get-WmiObject`, `Get-CimInstance` targeting `Win32_Group`) to gather local group information. Adversaries commonly use these methods to discover local system permission groups and identify users with elevated privileges, such as local administrators.
Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects a PowerShell process launch shortly after a .LNK file was created by Discord. This pattern is indicative of malicious LNK files distributed via Discord to gain initial execution.
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Detects the execution of the Oracle Database Scheduler's External Job process (`extjobo.exe`) spawning a suspicious child process, such as PowerShell with an encoded command or the Windows Command Shell. This behavior was observed in Elons ransomware attacks for initial access and remote command execution.
Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.
Detects PowerShell commands using encoded command-line arguments to execute 'net user', 'net group', or 'net share' commands. This technique is often used by adversaries to obfuscate their actions and evade detection.
This detection identifies potentially suspicious usage of Invoke-Sqlcmd PowerShell cmdlet, which can be used for database operations and potential data exfiltration. The detection looks for suspicious parameter combinations and query patterns that may indicate unauthorized database access, data theft, or malicious database operations. Threat actors may prefer using PowerShell Invoke-Sqlcmd over sqlcmd.exe as it provides a more flexible programmatic interface and can better evade detection.
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts.
This analytic identifies the execution of the PowerShell cmdlet `Get-WebGlobalModule`, which lists all IIS Modules installed on a system. It leverages PowerShell input data to detect this activity by capturing the module names and the image paths of the DLLs. This activity is significant for a SOC because it can indicate an attempt to enumerate installed IIS modules, which could be a precursor to exploiting vulnerabilities or misconfigurations. If confirmed malicious, this could allow an attacker to gain insights into the web server's configuration, potentially leading to further exploitation or privilege escalation.
The analytic detects the usage of PowerShell Cmdlets - New-WebGlobalModule, Enable-WebGlobalModule, and Set-WebGlobalModule, which are used to create, enable, or modify IIS Modules. This activity is significant as adversaries may use these lesser-known cmdlets to manipulate IIS configurations, similar to AppCmd.exe, potentially bypassing traditional defenses. If confirmed malicious, this could allow attackers to persist in the environment, manipulate web server behavior, or escalate privileges.
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
Page 120 of 160