Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell with common obfuscation or stealth-related flags (e.g., -enc, -nop, -w hidden) when initiated by CMD or from a LNK file, particularly when originating from Windows Explorer. This is a common pattern for malicious file execution and dropper activity.
Detects the use of PowerShell's System.Reflection.Assembly Load methods to dynamically load .NET assemblies into process memory from a byte array. This technique is often used by adversaries to execute malicious code directly in memory, bypassing disk-based detection mechanisms.
Detects PowerShell command lines that perform environment validation by enumerating running processes for security software (AV/EDR/Analysis tools) and querying WMI for virtualization artifacts. This behavior is consistent with anti-analysis and anti-sandbox evasion techniques used by threat actors, such as Kimsuky, to identify and verify the execution environment before proceeding with malicious activity.
Detects PowerShell scripts attempting to identify security software, virtualization environments, or sandbox analysis tools. The rule monitors for the enumeration of security processes, WMI queries for system hardware information (e.g., BIOS, Disk, Video Controller), and checks for registry keys or driver files associated with virtualization software (e.g., VMware, VirtualBox). This behavior is commonly observed in malware attempting to evade automated analysis.
Detects the reflective loading of .NET assemblies into memory using APIs like Assembly.Load or Reflection.Emit, where no corresponding DLL file is written to the disk. This technique is often used by malware (such as the Stella_Gary backdoor) to execute code in a fileless manner and evade disk-based security detections.
Detects the use of PowerShell to load .NET assemblies into memory using the Assembly.Load method. This technique is often employed by adversaries to execute malicious payloads reflectively, avoiding the creation of files on disk.
Detects the use of 'Localcertificate.zip' and associated PowerShell or certutil commands used to install a rogue root certificate authority into the Windows certificate store. This technique is often used by adversaries to enable TLS interception for credential and session theft.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
KQL Query from file: clickfix-mshtapowershell-run-dialog-exec-with-download-cradle-after-captcha-lu.kql
Detects Node.js or related helper processes executing shell commands (cmd.exe, powershell.exe) or other processes where the execution involves the 'withCreateProcessUser' argument. This often indicates attempts to bypass execution restrictions or run malicious payloads by utilizing Node.js as an execution proxy within unconventional or temporary directories.
This rule detects potentially malicious PowerShell execution patterns involving hidden windows, administrative elevation via 'Start-Process -Verb RunAs', and the targeting or execution of rsetup64.exe within specific system paths. It also flags execution chains where 'net session' commands, often used for discovery or local privilege verification, are piped to null and followed by or initiate the same target executables, suggesting lateral movement or persistence attempts.
Detects the use of PowerShell to modify Windows Defender security settings by adding exclusion paths or processes. This behavior is indicative of an adversary attempting to whitelist malicious files or processes to evade detection by the antivirus solution.
Detects the use of PowerShell cmdlets such as Invoke-WmiMethod, Invoke-CimMethod, Get-CimInstance, or Get-WmiObject to interact with the Win32_Process class for process creation on local or remote systems. This behavior is frequently associated with administrative activity but is also commonly used by adversaries for remote command execution and lateral movement.
Detects the use of PowerShell commands to add directory exclusions to Windows Defender settings. Adversaries often use this technique to exclude directories in 'AppData' from being scanned by antivirus solutions to hide malicious activity, tools, or persistence mechanisms.
Detects the execution of 'charmap.exe' from the Syswow64 directory where the process hierarchy indicates suspicious activity. The detection identifies a chain where PowerShell spawns 'conhost.exe', which in turn spawns a process from a temporary directory (interpreted as a renamed AutoIT executable) that then launches 'charmap.exe'. This pattern is indicative of a multi-stage obfuscated execution flow often used in malware dropper scenarios to bypass standard monitoring.
Detects the execution of PowerShell or PWSH with command-line arguments often used to obfuscate scripts or hide activity, such as encoded commands (-enc), base64 decoding, or running the process with a hidden window.
Detects the use of PowerShell cmdlets such as Invoke-WmiMethod, Invoke-CimMethod, Get-CimInstance, or Get-WmiObject to interact with the Win32_Process class for process creation on local or remote systems. This behavior is frequently associated with administrative activity but is also commonly used by adversaries for remote command execution and lateral movement.
Detects the use of PowerShell cmdlets such as Invoke-WmiMethod, Invoke-CimMethod, Get-CimInstance, or Get-WmiObject to interact with the Win32_Process class for process creation on local or remote systems. This behavior is frequently associated with administrative activity but is also commonly used by adversaries for remote command execution and lateral movement.
This rule detects potential attempts to tamper with Microsoft Defender security settings by creating or managing scheduled tasks that modify Defender exclusion paths. It correlates process execution (specifically schtasks.exe or PowerShell commands used for setting exclusions) with Windows Registry events that modify the Microsoft Defender exclusion path registry keys, flagging suspicious activity within a 15-minute window.
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Page 43 of 160