Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This analytic detects the execution of PowerShell commands that use the `Invoke-Command` cmdlet to start a process on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify such activities. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
This analytic detects the use of PowerShell environment variables to identify the current logged-in user by leveraging PowerShell Script Block Logging (EventCode=4104). Specifically, it monitors script blocks containing `$env:UserName` or `[System.Environment]::UserName`. This activity is significant because adversaries and Red Teams often use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this activity could allow attackers to gain insights into user context, aiding in further exploitation and lateral movement within the network.
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.
utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer.
This behavior is typically used during a kerberos or silver ticket attack.
A successful execution will output the SPNs for the endpoint in question.
This behavior is typically used during a kerberos or silver ticket attack.
A successful execution will output the SPNs for the endpoint in question.
Detects the execution of AzureHound in PowerShell, a tool to gather data from Azure for BloodHound
Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace.
This will bypass the default DNS server and uses a specified server for answering the query.
This will bypass the default DNS server and uses a specified server for answering the query.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be an indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. The usage of the WindowsInstaller COM object rather than msiexec could be an attempt to bypass detection.
Adversaries may log user keystrokes to intercept credentials as the user types them.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Winlogon Helper DLL
Sigma
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.
Powershell Timestomp
Sigma
Adversaries may modify file time attributes to hide new or changes to existing files.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
Adversaries may carry out malicious operations using a virtual instance to avoid detection
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Powershell use PassThru option to start in background
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Detects usage of the powerShell Set-Mailbox Cmdlet to set-up an SMTP forwarding rule.
Page 127 of 160