Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects the execution of specific PowerShell cmdlets related to Hyper-V virtual machine management. Adversaries may use these cmdlets to create, configure, or start virtual machines to evade detection by isolating malicious activities within a virtualized environment. The rule specifically looks for 'New-VM', 'Set-VMFirmware', and 'Start-VM' within PowerShell script block text.
This rule detects specific file paths, command-line arguments, and PowerShell commands associated with the Greenbug espionage group's May 2020 campaign, as reported by Symantec. It looks for suspicious executables in ProgramData directories, the use of 'revshell.exe' and 'ncat.exe' (especially with '-e cmd.exe'), and various PowerShell command patterns indicative of malicious activity, including base64 encoded strings.
This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
This rule detects the use of the PowerShell cmdlet 'Mount-DiskImage' with the '-ImagePath' parameter. Adversaries may use this technique to mount disk image files (like ISO or VHD) containing malicious payloads. This method can bypass Mark-of-the-Web (MOTW) controls, as files extracted or accessed from a mounted image may not inherit the MOTW, allowing them to execute without typical security warnings or protections.
Detects modifications to Windows Defender configuration settings using PowerShell to add exclusions. This activity is often performed by adversaries to disable or bypass security controls, allowing their malicious activities to go undetected.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
Detects suspicious PowerShell invocations using partial parameter names for common obfuscation techniques. This rule specifically looks for truncated forms of parameters like '-windowstyle hidden', '-NoProfile', '-NonInteractive', '-EncodedCommand', and '-ExecutionPolicy Bypass', which are frequently used by adversaries to hide their activity or bypass security measures.
Detects potential PowerShell execution from a DLL instead of the usual PowerShell process, as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
This rule detects the execution of PowerShell scripts that directly call a wide range of Windows API (WinAPI) functions. Adversaries often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell cmdlets or .NET methods. The rule specifically looks for a comprehensive list of sensitive WinAPI functions within the script block text, which can indicate various malicious activities such as process injection, privilege escalation, credential access, and memory manipulation. This rule is primarily intended for threat hunting to identify unusual and potentially malicious PowerShell script behavior.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects PowerShell script blocks that attempt to register an XLL (Excel Add-in) file using COM objects. Adversaries may abuse Microsoft Office add-ins, specifically XLL files, to establish persistence on a compromised system. The detection looks for the combination of 'new-object', '-ComObject', '.application', and '.RegisterXLL' within a PowerShell script block, indicating an attempt to programmatically register an XLL add-in.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
This rule detects suspicious PowerShell activity involving the mounting of a disk image (like ISO or VHD) and then immediately invoking an item from that mounted image. This technique is often used by adversaries to bypass Mark-of-the-Web (MOTW) protections, as files extracted or run from mounted disk images may not inherit the MOTW flag, allowing malicious payloads to execute without security warnings.
Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Page 146 of 160