Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects instances where PowerShell initiates process injection behaviors, specifically targeting common user-facing applications such as browsers (chrome.exe, msedge.exe), build tools (csc.exe), or indexing services (SearchIndexer.exe). The rule identifies memory allocation and thread manipulation activities often associated with reflective code injection or memory-based payloads.
Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.
Detects execution of PowerShell spawned by wscript.exe or cscript.exe attempting to retrieve a process-level environment variable named 'Kv[0-9]+'. This pattern is associated with 'LausivLoader', which uses environment variables to pass file paths or malicious payloads between a legacy script host and PowerShell. The rule optionally tracks attempts to delete associated files after the handoff.
Detects the spawning of a hidden PowerShell process by wscript.exe via conhost.exe with the --headless argument. This pattern is characteristic of the LausivLoader malware, which utilizes obfuscated command-line arguments to execute hidden PowerShell scripts.
Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.
Detects execution of PowerShell commands containing indicators of in-memory AMSI (Antimalware Scan Interface) patching, specifically referencing AmsiScanBuffer, AmsiScanString, or AmsiOpenSession in conjunction with amsi.dll. This behavior is associated with the initialization stage of LausivLoader prior to its payload retrieval phase.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects the use of PowerShell command lines containing both 'AesManaged' for decryption and '[System.Reflection.Assembly]::Load' for reflective loading of a .NET assembly in memory. This pattern is consistent with the execution stage of malware such as LausivLoader, which stage encrypted payloads and load them directly into the process memory to evade disk-based detection.
Detects the execution of PowerShell scripts that utilize a multi-stage deobfuscation and loading technique. The script decrypts a staged payload using AesManaged (with specific hardcoded byte constants), decompresses the result via GZipStream, and uses [System.Reflection.Assembly]::Load to reflectively execute the resulting .NET assembly in memory. This pattern is characteristic of advanced malware loader chains, such as those used by the 'LausivLoader'.
Detects a suspicious execution chain where WScript.exe initiates a process with '--headless' arguments, which in turn spawns a PowerShell process with hidden, encoded, and non-interactive command line flags. This pattern is commonly used by adversaries to execute malicious scripts while attempting to evade detection and user interaction.
This rule detects PowerShell script blocks that exhibit multiple indicators of obfuscation and in-memory execution. It identifies the combination of AES encryption, embedded key bytes commonly associated with deobfuscation routines, GZip compression, and reflective assembly loading (Assembly.Load). The use of multiple techniques simultaneously significantly increases the likelihood of malicious activity, such as fileless malware loading or execution of obfuscated payloads.
Detects attempts to modify Windows Defender security settings by adding exclusions to the scan path using various PowerShell cmdlets or WMI methods. This behavior is often associated with adversaries attempting to evade detection by excluding malicious tools or directories from antivirus scanning.
Detects attempts to disable Windows Defender Tamper Protection via direct Registry modification or by executing PowerShell commands. Disabling Tamper Protection is a common tactic used by adversaries to facilitate further malicious activity, such as impairing security controls or deleting malware artifacts without interference from Windows Defender.
This rule detects unauthorized memory modification of ntdll.dll, specifically targeting the EtwEventWrite function, by identifying processes writing to memory regions with execution-permission flags (e.g., PAGE_EXECUTE_READWRITE). This behavior is characteristic of adversaries attempting to blind Event Tracing for Windows (ETW) telemetry, often following suspicious .NET assembly loading (such as Assembly.Load) typical of malware loaders like LausivLoader.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Detects the execution of PowerShell commands that enumerate files within sensitive user directories such as Desktop, Downloads, Documents, or OneDrive, using common cmdlets like Get-ChildItem with recurrence or filtering. This behavior is indicative of an adversary attempting to discover or stage files for exfiltration.
Detects the use of PowerShell cmdlets and parameters to perform system, hardware, and external drive discovery. This includes querying volume information, disk/partition details, and checking for removable or specific bus-type media (USB, SD, MMC), which is commonly associated with reconnaissance activities by an adversary.
Detects the use of PowerShell to enumerate storage devices (USB, disk, partition information) and perform file operations such as copying or logging, potentially indicating malicious data collection from removable media or external drives.
Detects the execution of PowerShell with encoded commands in headless mode, associated with the Microsoft Edge Update Task (MicrosoftEdgeUpdateTaskUserS-1-5-24). This pattern is indicative of potential malicious activity where legitimate update tasks are abused to run obfuscated scripts.
Page 27 of 160