Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
This rule detects specific command-line patterns associated with FIN7's reconnaissance and POWERTRASH execution, as reported by WithSecureLabs. It looks for PowerShell commands that include '-noni -nop -exe bypass -f \\' and 'ADMIN$' or '-ex bypass -noprof -nolog -nonint -f' and 'C:\Windows\Temp\'. These patterns indicate attempts to execute PowerShell scripts, potentially for remote access or privilege escalation, often targeting administrative shares or temporary directories.
This rule detects the use of specific Windows API (WinAPI) libraries within PowerShell scripts. Attackers often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell function calls. The rule specifically looks for the presence of 'Advapi32.dll', 'kernel32.dll', 'KernelBase.dll', 'ntdll.dll', 'secur32.dll', and 'user32.dll' within the PowerShell script block text. This can indicate attempts to perform low-level system operations or interact with the operating system in a way that might evade higher-level monitoring.
Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.
Detects the execution of ADRecon.ps1, a PowerShell script used for Active Directory reconnaissance. The rule identifies specific function names and a default report filename commonly found within the ADRecon script. This tool has been reported to be actively used by the FIN7 threat group.
This rule detects the execution of the PowerShell cmdlet 'Remove-ADGroupMember' with parameters '-Identity' and '-Members'. This cmdlet is used to remove one or more members from an Active Directory group. In the context of this rule, it specifically targets the removal of an account from the 'Domain Admins' group, which could be an adversary's attempt to inhibit access to critical accounts or to clean up their tracks after gaining access.
This rule detects suspicious PowerShell process creations that include base64 encoded commands. It looks for PowerShell or pwsh executables being launched with the '-e', '-en', or '-enc' command-line arguments, combined with specific base64 encoded strings commonly associated with malicious activity (e.g., ' JAB', ' SUVYI', ' SQBFAFgA', ' aQBlAHgA', ' aWV4I', ' IAA', ' IAB', ' UwB', ' cwB'). It also includes a standalone detection for '.exe -ENCOD ' and ' BA^J e-' (reversed). This pattern is often used by malware like Emotet to obfuscate their command-and-control instructions or payloads.
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
This rule detects the execution of PowerShell scripts where the script path explicitly includes or references the "C:\Users\Public" directory. This directory is often used by adversaries to store and execute malicious scripts due to its default write permissions for all users, making it a common location for staging and executing payloads.
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
This rule detects suspicious command line patterns associated with MERCURY APT activity. Specifically, it looks for PowerShell execution with parameters '-exec bypass -w 1 -enc' combined with a base64 encoded string that decodes to 'Start-Job -ScriptBlock'. This indicates the execution of an encoded PowerShell script, often used by adversaries to obfuscate their commands and evade detection.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
This rule detects when PowerShell (powershell.exe or pwsh.exe) creates a new PowerShell script file (.ps1). While this behavior can be benign in many cases, it can also indicate a dropper script attempting to establish persistence on a system. The rule filters out common legitimate scenarios such as PowerShell's internal script policy tests and temporary files created in user AppData\Local\Temp or C:\Windows\Temp directories.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.
This rule detects PowerShell scripts that enumerate directories using `Get-ChildItem` and output the results to a file using `Out-File -append`. The detection logic specifically looks for the combination of `foreach`, `Get-ChildItem`, `-Path`, `-ErrorAction SilentlyContinue`, `Out-File`, and `-append` within the PowerShell script block text. This behavior has been associated with MAZE ransomware for directory discovery.
Detects the execution of SyncAppvPublishingServer.exe, which is often used by adversaries to bypass PowerShell execution restrictions. This technique is part of the LOLBAS (Living Off The Land Binaries and Scripts) project, where legitimate system binaries are abused for malicious purposes, specifically to execute PowerShell commands in a way that might evade traditional security controls.
Page 147 of 160