Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell commands that leverage Reflection.Assembly.Load, a common technique for loading .NET assemblies directly into memory. This behavior is often associated with fileless malware, reflective DLL injection, or obfuscated payloads attempting to bypass security controls like AMSI.
This rule detects the manual instantiation of PowerShell ScriptBlock objects via the '::Create' method. This technique is commonly used by malicious PowerShell scripts and offensive security tools to bypass traditional command-line logging by executing code dynamically in memory, often avoiding disk-based signatures.
Detects a sequence of PowerShell commands consistent with the VelvetCake reconnaissance module, including enumeration of antivirus software via SecurityCenter2, system information, IP configurations, running processes, recent files, and drive mapping within a short timeframe.
Detects the execution of PowerShell with hidden window style and long Base64 or encoded command strings, which is a common technique used by attackers to execute obfuscated malicious scripts while minimizing visibility on the endpoint.
This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.
This rule detects persistence mechanisms involving the creation or modification of a specific Windows Registry Run key ('ComponentTask33Agent') within the HKEY_CURRENT_USER hive, or the execution of PowerShell commands targeting this specific registry value. This is indicative of malware, such as the ChainScript Node.js RAT, attempting to maintain access across user reboots by abusing standard Windows autostart configuration points.
Detects the execution of PowerShell or pwsh with encoded command arguments containing a long base64 string, often used by attackers to hide malicious scripts from command-line logging and basic static analysis.
Detects in-memory modification of the AmsiScanBuffer function within PowerShell processes, specifically targeting the injection of patch instructions (e.g., MOV EAX, 80070057; RET). This technique is characteristic of .NET loaders like PIVOTPIPE attempting to bypass Antimalware Scan Interface (AMSI) inspection before executing malicious payloads.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects instances where Windows Explorer (explorer.exe) spawns PowerShell with heavily obfuscated command lines, characterized by caret-obfuscation and execution policy bypass flags. This pattern is characteristic of ClickFix social engineering, where a user is tricked into pasting malicious commands into the Windows Run dialog.
Detects the execution of PowerShell with common obfuscation flags (-W Hidden, -nop, -nol) that attempt to load and execute a script directly from the user's local Temp directory. The detection specifically monitors for processes launched by command interpreters like cmd.exe or batch files, which is a common indicator of a malware dropper or stager.
Detects execution of PowerShell commands that exhibit characteristics frequently associated with malicious activity, such as reflective assembly loading, compression/decompression operations, use of specific known obfuscation markers, encoded commands, or execution originating from suspicious parent processes like explorer.exe or cmd.exe.
This rule monitors for suspicious PowerShell command-line activity originating from Windows Explorer (explorer.exe) or embedded within RunMRU registry modifications. It detects obfuscated or hidden command execution patterns, such as base64 encoding, the use of -EncodedCommand, Invoke-Expression, or execution policy bypass flags, which are commonly associated with malicious scripts and fileless malware execution.
Detects post-exploitation shell activity spawned from the IIS worker process (w3wp.exe), narrowed to command lines carrying encoded/obfuscated PowerShell flags, remote-download cradles, or basic recon/persistence commands (whoami, certutil, bitsadmin, schtasks, reg add). This reduces noise from benign w3wp.exe-initiated automation while retaining the behavioral pattern seen in the Telerik UI for ASP.NET AJAX unauthenticated RCE chain (webshell/in-memory DLL execution dropping to a shell).
Detects the execution of PowerShell from a shortcut (.lnk) file, particularly when suspicious command-line arguments such as hidden windows, encoded commands, or bypass flags are utilized. This pattern is commonly associated with initial access via malicious attachments or shortcut files.
Detects the loading of .NET Common Language Runtime (clr.dll) and System.Management.Automation.dll into a process that is not a recognized PowerShell binary (e.g., powershell.exe, pwsh.exe). This behavior is associated with the 'PSInline' technique used by SloppyRAT, where PowerShell capabilities are invoked directly via COM objects to execute commands in memory. The rule further correlates this activity with the creation of files with a .png extension in temporary directories, which is consistent with the exfiltration staging behavior of the malware.
Detects the use of PowerShell to reflectively load .NET assemblies into memory, often associated with fileless malware execution. The rule monitors for common reflection-based methods (e.g., Assembly.Load, [System.Reflection.Assembly]) in conjunction with encoded command patterns or script execution.
Detects the execution of base64 encoded PowerShell commands initiated by conhost.exe with the --headless flag. The decoded command contains specific suspicious patterns, including accessing environment variables, reading file content, and deleting files, which is characteristic of malicious scripts attempting to stealthily interact with the environment.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
Page 29 of 160