Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
This rule identifies attempts to clear the PowerShell console history. Adversaries often clear command history to remove traces of their activities on a compromised system, making forensic analysis more difficult. The rule specifically looks for the 'Clear-History' cmdlet or the deletion of the 'ConsoleHost_history.txt' file, which stores PowerShell command history.
This rule detects the installation of a root certificate on a Windows system via PowerShell. It specifically looks for PowerShell script block text containing commands like 'Move-Item' or 'Import-Certificate' targeting the 'Cert:\LocalMachine\Root' path. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. This method can be used for defense evasion by leveraging a trusted system utility (PowerShell) and a legitimate WMI class to install software, potentially bypassing traditional application whitelisting or execution policies.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
This rule detects the use of PowerShell cmdlets to exfiltrate email addresses. Specifically, it looks for PowerShell processes executing commands that include 'Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', and '-hidetableheaders'. This combination of cmdlets is indicative of an attempt to enumerate and extract email addresses from a system, likely for exfiltration purposes.
Detects the deletion of Windows Volume Shadow Copies using PowerShell with WMI (Get-WmiObject/Get-CimInstance) or CIM (Remove-WmiObject/Remove-CimInstance) commands. This technique is commonly employed by ransomware families like Sodinokibi/REvil to prevent system recovery.
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
Detects unusually long PowerShell command lines (1000 characters or more) which can be indicative of obfuscated or complex malicious scripts being executed. Attackers often use long command lines to evade detection by packing malicious code, base64 encoded commands, or other obfuscation techniques into a single line.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
This rule detects the creation of a new Windows service where the ImagePath contains 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell'. This specific combination is indicative of an attempt to execute obfuscated PowerShell code via rundll32.exe, a common technique for defense evasion and execution.
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
Detects the usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" with the '-Online' parameter to enable specific Windows optional features. This cmdlet is similar to DISM.exe and can be used to enumerate, install, uninstall, configure, and update features and packages in Windows images. The rule specifically looks for the enabling of potentially suspicious features like Telnet Server, Internet Explorer, TFTP Client, SMB1 Protocol, Client-ProjFS, and Microsoft-Windows-Subsystem-Linux.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.
Page 149 of 160