Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects attempts by a user or attacker to clear PowerShell session command history or delete the ConsoleHost_history.txt file, which stores past PowerShell commands, often used as part of anti-forensics or indicator removal during an intrusion.
Detects the use of PowerShell to execute the 'Set-MpPreference' command with the 'DisableRealtimeMonitoring' parameter set to true. This technique is commonly used by adversaries to impair Windows Defender security controls and avoid detection during the post-compromise phase.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects a hidden, non-interactive PowerShell process that programmatically enumerates mounted disk images (VHDX/ISO) using Get-DiskImage or Get-Partition, dismounts them, and potentially deletes the backing files. This behavior is indicative of post-execution cleanup routines used by malware delivered via mounted container images, such as the Overlord RAT.
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the execution of PowerShell scripts associated with unauthorized Active Directory information gathering. This includes the execution of specific scripts from ProgramData and the logging of known reconnaissance commands or script contents within PowerShell event logs.
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
Detects PowerShell script block execution containing patterns associated with network discovery, specifically splitting IP strings and calculating /24 subnets, often indicative of host or network reconnaissance.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects the creation of a hidden scheduled task using the Schedule.Service COM object, where the author field is explicitly set to 'Microsoft Corporation' to masquerade as a legitimate system task.
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Page 55 of 160