Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
Detects keywords within PowerShell module logs that indicate an attempt to clear PowerShell history. This includes commands like 'Remove-Item' or 'del' targeting the history file path, or 'Set-PSReadlineOption' to disable history saving.
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
Detects usage of PowerShell cmdlets to disable or remove Event Tracing for Windows (ETW) trace sessions. This activity can be an attempt by an adversary to impair defenses by blocking or removing indicators that would normally be collected by security monitoring tools.
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
This rule detects PowerShell script execution that attempts to enumerate installed software on a Windows system. Specifically, it looks for the combination of `Get-ItemProperty`, `\software\`, `Select-Object`, and `Format-Table` within the PowerShell script block text. This pattern is commonly used to query the registry for installed applications under `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\` and format the output.
This rule detects PowerShell commands that attempt to store data in an Alternate Data Stream (ADS) by redirecting the output of a command executed via `cmd.exe` (comspec) into a file using the `>` operator. This technique is often used by malware, such as Astaroth, to hide malicious data within legitimate files, making it harder to detect.
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects the use of 'X509Enrollment' objects within PowerShell scripts. Adversaries may use X509Enrollment to install root certificates, which can be leveraged to bypass security warnings when connecting to adversary-controlled web servers or to sign malicious code, thereby subverting trust controls and enabling defense evasion.
Detects the execution of the Microsoft-signed PowerShell script 'Launch-VsDevShell.ps1' with specific command-line arguments ('VsWherePath ' or 'VsInstallationPath '). This script can be abused to proxy the execution of other commands, potentially for defense evasion.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
This rule detects the execution of the 'Get-NetTCPConnection' PowerShell cmdlet. This cmdlet is used to retrieve information about TCP connections on a system. Adversaries may use this for system network connections discovery to understand the network environment of a compromised host.
This rule detects attempts to clear PowerShell command history, which adversaries might do to remove traces of their activities. It looks for specific PowerShell commands and keywords related to deleting history files or configuring PowerShell to not save history. This includes commands like 'del', 'Remove-Item', 'rm' in conjunction with the PowerShell history path, or setting 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'.
This rule detects attempts to dump credentials from the Windows Credential Manager using PowerShell. It specifically looks for the use of known PowerShell functions or code patterns associated with credential dumping tools or techniques. This includes functions like 'Get-PasswordVaultCredentials' and 'Get-CredManCreds', as well as the instantiation of .NET objects related to 'Windows.Security.Credentials.PasswordVault' or specific CSharpCodeProvider patterns often used in reflective loading or dynamic compilation for credential access.
Detects the usage of `[Reflection.Assembly]::load` functions within PowerShell script block logs. This method allows for dynamically loading assemblies into memory, which can be used by adversaries to execute malicious code without writing it to disk, thus evading traditional file-based detections.
Page 151 of 160