Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell with encoded commands, a common technique used by attackers to obfuscate malicious scripts and evade detection.
Detects reconnaissance patterns associated with SynkLoader, specifically focusing on in-memory PowerShell execution used to harvest system information, user privileges, running services, process listings, and Active Directory computer counts.
Detects the deletion of Volume Shadow Copies using native Windows utilities like WMIC or PowerShell cmdlets (Get-WmiObject, Get-CimInstance) targeting Win32_ShadowCopy. This behavior is a common indicator of ransomware preparation to inhibit system recovery prior to encryption, as observed in attacks involving the Akira ransomware.
Detects the use of PowerShell commands that leverage .NET AES cryptography with CBC mode to decrypt payloads in-memory, subsequently executing the resulting code directly via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass disk-based signature detection.
Detects instances where PowerShell.exe is launched by a process that has loaded specific Visual C++ Redistributable DLLs (msvcp150.dll or msvcp160.dll). This pattern is often associated with the execution of applications built with Visual Studio 2017/2019 that may be acting as loaders or wrappers for malicious PowerShell scripts.
Detects execution of a PowerShell script named 'rust-setup.ps1' or network connectivity to a specific external IP address (23.254.165.112:443) identified as a stage-2 payload delivery or command-and-control communication in a supply chain attack scenario.
Detects behavioral indicators associated with the ChocoShell malware, a fileless PowerShell-based infostealer. The rule monitors for malicious command-line activity including AMSI bypass, credential theft from Token Broker and WLAN profiles, disabling of Microsoft Defender signatures, and communication with local API endpoints typical of the CornFlake controller.
Detects the creation of a shortcut file named 'SystemIn.lnk' using PowerShell, a technique associated with the QUICSILVER malware to establish persistence. The rule monitors for PowerShell command-line arguments involving 'WScript.Shell' and 'CreateShortcut' alongside the specific file name.
Detects unauthorized command-line shell execution (cmd.exe or powershell.exe) spawned by the process 'Windowsupdate.exe', or the execution of a file associated with the malicious hash attributed to the QUICAgent backdoor.
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory.
These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.
These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.
Pulls the full content of every PowerShell, VBS, and JS script executed on a given host. Use * in both parameters to get everything
Detects suspicious execution of 'browsercore.exe' using common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern monitors for specific command-line arguments involving file redirection, content retrieval, or process spawning, which are often indicative of malicious activity or attempts to bypass security controls by leveraging legitimate-looking browser-related binaries.
Detects the execution of PowerShell with hidden window arguments that utilize a combination of hex-encoded character arrays, the -join operator, and Invoke-Expression (iex). This technique is commonly employed by attackers to execute obfuscated, memory-resident payloads while evading detection by security solutions.
Detects a suspicious execution chain where wscript.exe is used to run a file named 'rust-setup-launch.vbs' from a temporary directory, which subsequently triggers powershell.exe to execute a script named 'rust-setup.ps1'. This behavior is indicative of a staged supply chain attack.
Detects PowerShell or pwsh processes spawned from Teams.exe with command-line arguments indicative of remote download and execution (e.g. Invoke-WebRequest, curl, encoded commands, IEX, Invoke-Expression, Expand-Archive of a zip archive). This pattern matches the TWINLOOT campaign's initial access chain, in which victims are lured via fake Microsoft Teams messages (T1566.004) into launching malicious content that triggers PowerShell execution (T1059.001) from within the Teams process, consistent with user execution of a malicious link or file (T1204.002).
This rule detects PowerShell commands that programmatically create a Windows shortcut (.lnk file) targeting a startup folder or mimicking Windows update processes. This behavior is indicative of an adversary attempting to establish persistence by creating a shortcut that executes a malicious script or binary upon user login or system startup, often associated with the QUICSILVER campaign.
Detects the creation of a scheduled task via the Windows COM interface, a technique used by malware like SynkLoader to bypass command-line monitoring (e.g., schtasks.exe). The rule monitors Windows Security Event IDs 4698 and 4702 for tasks configured to trigger on logon that execute script-based content (Python or PowerShell) from user-writable directories.
This rule detects PowerShell processes performing file downloads using common commands (such as Invoke-WebRequest, BITS, or Certutil) and saving or targeting files within user-profile specific directories (AppData). This behavior is often indicative of an adversary staging malicious tools or payloads in a writeable user directory.
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Detects execution chains where archive utilities (7-Zip, WinRAR) or explorer.exe, when initiated from temporary or download directories, spawn common scripting engines (PowerShell, mshta.exe, cmd.exe, wscript.exe) that contain suspicious network-related or obfuscated command-line indicators.
Detects the creation of a 'SystemIn.lnk' shortcut file within the Windows Startup folder, as well as the execution of temporary PowerShell scripts ('create_lnk_*.ps1') that use WScript.Shell to establish persistence. This behavior is associated with the QUICAgent backdoor attributed to Operation QUICSILVER.
Page 51 of 160