Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell to modify Microsoft Defender (MpPreference) settings by adding specific directories or files to the exclusion list. This behavior is frequently associated with adversaries attempting to evade security detection by ensuring malicious tools, staged payloads, or persistent files remain unscanned by the antivirus engine.
Detects the execution of PowerShell commands using 'Add-MpPreference -ExclusionPath' initiated by the CRUDEEXCLUDE Delphi utility. This behavior is associated with threat actors staging directories for the deployment of HEAVYGRAM/SHADEGENES payloads.
Detects a suspicious sequence of PowerShell commands associated with HEAVYGRAM-related droppers. The rule identifies processes that attempt to bypass security protections by adding Windows Defender exclusion paths, followed by registry-based persistence mechanisms (Run keys) that target common malicious executables such as RuntimeSSH.exe or winappx.exe.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects the execution of PowerShell encoded commands that result in the installation of known remote monitoring and management (RMM) software. This pattern is indicative of attackers, specifically those associated with Ransom Busters or similar affiliates, establishing persistent remote access to compromised systems.
Detects the execution of PowerShell or Rundll32 processes with command-line arguments that reference Anti-Malware Scan Interface (AMSI) components. This is a common indicator of an attempt to bypass or disable AMSI to facilitate the execution of malicious scripts or payloads.
Detects the execution of 'charmap.exe' from the Syswow64 directory where the process hierarchy indicates suspicious activity. The detection identifies a chain where PowerShell spawns 'conhost.exe', which in turn spawns a process from a temporary directory (interpreted as a renamed AutoIT executable) that then launches 'charmap.exe'. This pattern is indicative of a multi-stage obfuscated execution flow often used in malware dropper scenarios to bypass standard monitoring.
This KQL query hunts for PowerShell commands hidden within PowerShell scripts, flagging keywords seen in there that are commonly associated with malicious activity.
Detects PowerShell command execution patterns indicative of the VelvetCake malware module. The rule identifies scripts that enumerate files within the C:\Users\Public directory, calculate file metrics using [math]::Round, and stage discovered files for transmission over a raw TCP connection using System.Net.Sockets.TcpClient.
Detects the use of PowerShell to load .NET Windows Forms and Drawing assemblies to perform screen captures. This behavior is associated with the VelvetCake second-stage module, which uses these libraries to capture full display screenshots and save them as timestamped PNG files to temporary directories.
Detects the RevStealer malware family using an Electron-based loader to perform anti-sandbox host validation. The loader attempts to identify virtualized environments by querying GPU hardware information using wmic or PowerShell CIM/WMI commands before proceeding to disable security features or launch the payload.
Detects the inclusion of PowerShell download commands ('irm' or 'Invoke-RestMethod') within the Windows 'RunMRU' registry key. This key is used by Windows Explorer to track recently typed run commands, and adversaries often abuse it to maintain persistence or store malicious one-liner payloads that are intended to be executed at a later time.
Detects the use of PowerShell commands that reflectively load assemblies into memory, often associated with obfuscated or encoded payloads typically used in fileless malware execution and post-exploitation activity.
Detects the execution of PowerShell commands intended to gather system information, specifically targeting the discovery of security software (anti-virus/EDR) and virtualization/sandbox artifacts. This behavior is indicative of an attacker performing environment reconnaissance to identify defensive controls or to determine if the payload is executing within an analysis environment.
Detects the execution of an LNK file that initiates a command chain resulting in an encoded PowerShell script. This behavior is indicative of malicious shortcut files often used in initial access to trigger multi-stage payloads, consistent with techniques observed in Kimsuky-linked infection chains.
Detects the execution of a .lnk file that directly triggers a PowerShell process. This behavior is frequently associated with malicious shortcut files used in initial access and execution, such as those observed in Kimsuky (APT-C-55) infection chains where disguised installers drop LNK files that execute PowerShell scripts for anti-analysis and subsequent payload deployment.
Detects execution of PowerShell spawned by suspicious processes (e.g., installers or Windows Explorer) involving LNK file patterns or suspicious command-line obfuscation techniques commonly associated with Kimsuky (APT-C-55) activity.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
Page 37 of 160