Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of the 'Get-Clipboard' PowerShell cmdlet via the command line interface. This cmdlet is used to retrieve the current content of the clipboard, which could be leveraged by adversaries for data collection.
Detects the use of the "Set-Service" PowerShell cmdlet to modify a service's Security Descriptor Definition Language (SDDL) to hide the service from standard enumeration utilities like "sc.exe" or "Get-Service". This technique leverages specific SDDL flags (DCLCWPDTSD) to restrict access and visibility, primarily effective in PowerShell 7 environments.
Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.
Detects PowerShell scripts that utilize compression and decompression techniques, specifically looking for 'new-object', 'text.encoding]::ascii', 'system.io.compression.deflatestream', 'system.io.streamreader', and 'readtoend' in the payload. This pattern is indicative of obfuscated PowerShell often used by tools like Invoke-Obfuscation to hide malicious code.
Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.
Detects obfuscated PowerShell execution leveraging MSHTA. This technique is often used for defense evasion by adversaries to execute malicious scripts without directly invoking PowerShell. The rule specifically looks for a combination of keywords indicative of this method, including 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' within the PowerShell module payload.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
Detects code fragments commonly found in small and obfuscated PowerShell scripts designed to bypass Antimalware Scan Interface (AMSI). The rule specifically looks for the combination of '[Ref].Assembly.GetType', 'SetValue($null,$true)', and 'NonPublic,Static' within PowerShell script block text, which are indicative of reflection-based AMSI bypass techniques.
This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.
This rule detects the use of `System.DirectoryServices.AccountManagement` within PowerShell script block logs. This .NET namespace is commonly used to programmatically manage Active Directory security principals such as users, computers, and groups. Adversaries may use this method to create new domain accounts, modify existing ones, or manipulate group memberships to establish persistence or elevate privileges within an Active Directory environment.
Detects obfuscated PowerShell scripts that utilize 'clip.exe' to interact with the clipboard, potentially for defense evasion or data manipulation. The rule specifically looks for the pattern 'echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?)' within PowerShell script block text, indicating an attempt to pipe output to clip.exe and then interact with the clipboard or invoke further commands.
This rule detects the use of PowerShell to instantiate the MsXml2.XmlHttp COM object. Adversaries may abuse PowerShell commands and scripts for execution, and the MsXml2.XmlHttp COM object can be used for network communication, such as downloading additional payloads or exfiltrating data. This technique is often used by malware or attackers to perform actions like C2 communication or data transfer.
This rule detects the use of 'PromptForCredential' within PowerShell script block logs. This function is used to display a dialog box that prompts the user for credentials, which can be abused by adversaries to harvest user credentials. Detection relies on PowerShell Script Block Logging being enabled.
Detects the use of the PSAttack PowerShell hack tool by looking for the specific string 'PS ATTACK!!!' within PowerShell script block logs. This tool is often used for post-exploitation activities.
Detects PowerShell script blocks that manipulate security descriptors using specific WMI classes and properties (win32_Trustee, win32_Ace, .AccessMask, .AceType, .SetSecurityDescriptor) in conjunction with specific LSA registry paths (Lsa\JD, Lsa\Skew1, Lsa\Data, Lsa\GBG). This combination is indicative of potential persistence mechanisms, as seen in projects like DAMP, which aim to backdoor systems by modifying security settings to maintain access or elevate privileges.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects PowerShell script execution where the 'WindowStyle Hidden' option is used. Adversaries often use this technique to conceal malicious activity from users by preventing the PowerShell window from being visible. The rule specifically looks for the combination of 'powershell', 'WindowStyle', and 'Hidden' within the script block text. A filter is applied to exclude legitimate Amazon WorkSpaces configuration scripts that use this option.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects a suspicious PowerShell download cradle that leverages nslookup to extract payloads from DNS TXT records. This technique is often used for defense evasion by adversaries to retrieve malicious code or data over DNS.
Page 153 of 160