Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
This rule detects the execution of PowerShell commandlets and functions associated with the Nishang exploitation framework. Nishang is a collection of PowerShell scripts and functions that enable penetration testers to use PowerShell for offensive security tasks. The rule specifically looks for a comprehensive list of known Nishang commandlet names and arguments within PowerShell script block logs. Detection of these strings indicates potential malicious activity, including credential dumping, persistence mechanisms, exfiltration, and remote code execution.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.
Detects the use of 'PSAsyncShell', an asynchronous TCP reverse shell written in PowerShell. The rule specifically looks for the string 'PSAsyncShell' within PowerShell script block logs, indicating the execution or presence of this specific tool.
This rule detects the execution of PowerShell scripts containing specific Base64 encoded shellcode signatures. The rule looks for the presence of 'OiCAAAAYInlM' or 'OiJAAAAYInlM' within the ScriptBlockText, which are known indicators of shellcode.
This rule detects the execution of specific PowerShell commandlets associated with the ShellIntel exploitation framework. These commandlets, such as 'Invoke-SMBAutoBrute', 'Invoke-GPOLinks', and 'Invoke-Potato', are commonly used for reconnaissance, privilege escalation, and lateral movement within a Windows environment. Detection relies on PowerShell Script Block Logging to capture the script text containing these commandlet names.
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
This rule detects the use of the PowerShell cmdlet 'Unblock-File' with the '-Path' parameter. This cmdlet is used to remove the Zone.Identifier alternate data stream from a file, which marks it as downloaded from the internet. Adversaries may use this to bypass security warnings and execution restrictions associated with files downloaded from untrusted sources, often as part of a defense evasion strategy.
This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.
Detects the use of the Microsoft signed script "CL_mutexverifiers.ps1" to proxy the execution of additional PowerShell script commands. This technique can be used by adversaries for defense evasion by leveraging a trusted, signed script to execute malicious code.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Page 152 of 160