Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
Detects obfuscated PowerShell execution using environment variables, specifically looking for patterns indicative of Invoke-Obfuscation's VAR+ launcher. This technique involves setting environment variables with parts of a command and then reconstructing and executing it, often to evade detection.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Detects the use of the PowerShell 'Write-EventLog' cmdlet in conjunction with the '-RawData' flag. This combination can be exploited by adversaries to embed malicious payloads within Windows Event Logs, which can then be retrieved later. This technique is often employed for defense evasion, allowing attackers to conceal their activities within seemingly legitimate system logs. Detection relies on PowerShell Script Block Logging being enabled.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.
This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.
This rule detects the execution of PowerShell commands via `cmd.exe` where the PowerShell script is passed through standard input (STDIN) and includes obfuscation techniques. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to pipe output to `powershell.exe`, and the PowerShell command itself contains either `${input}` or `noexit` along with `Invoke-Expression` and `DownloadString` patterns, indicative of obfuscated remote code execution.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
Detects code execution where PowerShell (powershell.exe or pwsh.exe) is the parent process and its command line contains references to the Pester module, specifically when Pester is used to invoke other commands or scripts. This could indicate an adversary leveraging Pester for execution, potentially for defense evasion or to bypass security controls.
This rule detects PowerShell command lines that exhibit characteristics of obfuscation by looking for repeated special characters such as '+', '{', '^', and '`'. These patterns are commonly used by adversaries to evade detection by making the command less readable or to bypass signature-based defenses. The rule specifically targets PowerShell (powershell.exe) and PowerShell Core (pwsh.exe) processes.
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Page 155 of 160