Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell to perform webcam image capture by utilizing .NET reflection with 'System.Drawing' and 'System.Windows.Forms' namespaces. This technique has been identified as being used by the TOKYOCORE ransomware to perform victim surveillance by capturing and saving camera snapshots as PNG files.
This rule detects potential ransomware activity by monitoring for specific PowerShell commands associated with file encryption (AES, CreateEncryptor, TransformFinalBlock) and suspicious file manipulation patterns, such as mass renaming of files with common ransomware extensions or the dropping of known ransom note filenames.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects the use of PowerShell to perform reflective assembly loading of a payload that has been decrypted using AES and decompressed with GZip. This pattern is commonly used by attackers to load malicious .NET assemblies directly into memory while bypassing static file-based detection.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects the use of PowerShell to perform reflective assembly loading of a payload that has been decrypted using AES and decompressed with GZip. This pattern is commonly used by attackers to load malicious .NET assemblies directly into memory while bypassing static file-based detection.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the execution of PowerShell via mshta.exe or wscript.exe, specifically when the command line includes encoded commands. This is a common pattern for attackers using living-off-the-land binaries to execute obfuscated malicious payloads, bypassing basic security controls.
Page 54 of 160