Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of .NET AesCryptoServiceProvider in PowerShell scripts, which is frequently used by adversaries to decrypt embedded, obfuscated, or encrypted payloads within a script for malicious execution.
Detects PowerShell invoking the .NET CopyFromScreen method to capture a screenshot and write it to shot.png, spawned as a child process of pythonw.exe. This behavior matches the TWINLOOT Python implant, which abuses trusted Microsoft cloud services for C2 and uses pythonw.exe to launch PowerShell for screen capture as part of its credential harvesting and reconnaissance capabilities.
The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response.
The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking
activities.
This can ensure that their C2 is not blocked by any firewalls.
The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking
activities.
This can ensure that their C2 is not blocked by any firewalls.
Windows PowerShell Password Input Window
Cortex XDR
Detects a user-session window titled 'Password Input' associated with PowerShell, PowerShell Core, or PowerShell ISE processes. This technique may be used for GUI-based credential capture or social engineering.
Detects the execution or installation of the cloudflared utility via PowerShell, which is often used by adversaries to establish persistence or remote access tunnels (Cloudflare Tunnel). The rule triggers on process command lines involving 'cloudflared' and '1.ps1' keywords commonly associated with scripted deployment.
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
This rule detects PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) that execute the 'Compress-Archive' cmdlet in conjunction with strings indicative of data staging or exfiltration workflows (e.g., 'ZIPDOWNLOAD', '-DestinationPath'). The detection logic further narrows the scope by identifying if the parent process (InitiatingProcessCommandLine) involved activities related to downloading or uploading files, suggesting an automated staging and potential exfiltration sequence often seen in malicious backdoors.
This rule detects potentially malicious PowerShell activity characterized by the co-occurrence of file download indicators (such as Invoke-WebRequest, WebClient, or UserAgent strings) and file execution or staging commands (such as IEX, Expand-Archive, or Copy-Item) within the same command line. It is designed to identify ingress tool transfer and command-line execution patterns often associated with post-exploitation or malware staging, while reducing noise by requiring both download and operational intent.
Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.
Detects potential data exfiltration attempts using PowerShell by identifying Invoke-WebRequest usage with specific flags (Put, ContentType, InFile) or encoding patterns (EncodedCommand) while targeting sensitive file extensions, directories, or suspicious network destinations.
This detection identifies instances where a Microsoft Office application (Word, Excel, PowerPoint, or Outlook) spawns a child process commonly associated with script execution or living-off-the-land binary (LOLBin) abuse — including wscript.exe, cscript.exe, mshta.exe, powershell.exe, cmd.exe, regsvr32.exe, rundll32.exe, certutil.exe, and bitsadmin.exe.
This behavior is a well-known indicator of malicious macro or embedded-object execution following a phishing lure: a victim opens a weaponized document, and a macro (or OLE/DDE object) launches a script interpreter or LOLBin to download, decode, or execute a second-stage payload. Office applications rarely need to spawn these processes during legitimate use, making this a high-fidelity pivot point for detecting initial access and user-execution activity.
Rationale
Office applications spawning script hosts or command interpreters is atypical for normal document/spreadsheet/presentation workflows.
Threat actors frequently abuse Office macros (VBA), DDE, or OLE objects as an initial access vector, then use LOLBins to evade detection and blend in with legitimate system activity.
Tools like mshta.exe, certutil.exe, and bitsadmin.exe are commonly abused for downloading and executing remote payloads while evading traditional AV/EDR signatures.
MITRE ATT&CK Mapping
Technique Tactic
T1566 (Phishing) Initial Access
T1204 (User Execution) / T1204.002 (Malicious File) Execution
T1059 (Command and Scripting Interpreter) Execution
T1218 (System Binary Proxy Execution) — e.g. T1218.005 Mshta, T1218.010 Regsvr32, T1218.011 Rundll32 Defense Evasion
T1197 (BITS Jobs) Defense Evasion, Persistence
T1140 (Deobfuscate/Decode Files or Information) — via certutil Defense Evasion
Data Source
Microsoft Defender for Endpoint — DeviceProcessEvents
Logic Summary
Flags process creation events over the last 30 days where:
The initiating (parent) process is winword.exe, excel.exe, powerpnt.exe, or outlook.exe, and
The spawned (child) process i
This behavior is a well-known indicator of malicious macro or embedded-object execution following a phishing lure: a victim opens a weaponized document, and a macro (or OLE/DDE object) launches a script interpreter or LOLBin to download, decode, or execute a second-stage payload. Office applications rarely need to spawn these processes during legitimate use, making this a high-fidelity pivot point for detecting initial access and user-execution activity.
Rationale
Office applications spawning script hosts or command interpreters is atypical for normal document/spreadsheet/presentation workflows.
Threat actors frequently abuse Office macros (VBA), DDE, or OLE objects as an initial access vector, then use LOLBins to evade detection and blend in with legitimate system activity.
Tools like mshta.exe, certutil.exe, and bitsadmin.exe are commonly abused for downloading and executing remote payloads while evading traditional AV/EDR signatures.
MITRE ATT&CK Mapping
Technique Tactic
T1566 (Phishing) Initial Access
T1204 (User Execution) / T1204.002 (Malicious File) Execution
T1059 (Command and Scripting Interpreter) Execution
T1218 (System Binary Proxy Execution) — e.g. T1218.005 Mshta, T1218.010 Regsvr32, T1218.011 Rundll32 Defense Evasion
T1197 (BITS Jobs) Defense Evasion, Persistence
T1140 (Deobfuscate/Decode Files or Information) — via certutil Defense Evasion
Data Source
Microsoft Defender for Endpoint — DeviceProcessEvents
Logic Summary
Flags process creation events over the last 30 days where:
The initiating (parent) process is winword.exe, excel.exe, powerpnt.exe, or outlook.exe, and
The spawned (child) process i
Detects PowerShell command lines that fetch a remote module using methods like DownloadString or Invoke-WebRequest, subsequently executing the downloaded code in-memory via Invoke-Expression (iex), and finally invoking a main() function. This pattern matches the execution chain used by the CountLoader malware (taskType 5).
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
This rule detects PowerShell processes attempting to bypass the Antimalware Scan Interface (AMSI) via .NET reflection, specifically targeting 'AmsiUtils' or 'amsiInitFailed' fields. To reduce noise, it correlates this activity with the presence of WinHTTP COM objects (for network evasion) or timing-based functions (e.g., Stopwatch, GetTickCount) often used for anti-sandbox or anti-analysis evasion, characterizing behavior consistent with the ChocoShell malware family.
Page 52 of 160