Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects anomalous, high-frequency usage of Active Directory PowerShell cmdlets (e.g., Get-ADUser, Get-ADGroup) by a single user or process within a short timeframe, which is a common indicator of internal domain reconnaissance by an adversary.
This rule detects discovery of domain controllers in an Active Directory environment. It monitors for the use of 'nltest.exe' with the '/dclist' argument and specific PowerShell cmdlets or methods used to identify domain controllers, such as 'Get-ADDomainController', '[System.Net.Dns]::GetHostEntry', or querying '$env:LOGONSERVER'.
Detects the execution of known Active Directory enumeration scripts or commands via PowerShell shortly after a Remote Desktop (RDP) login session is established on a device. This pattern is indicative of an attacker who has gained remote access and is immediately performing discovery activities.
Detects the execution of known offensive PowerShell scripts used for Active Directory information gathering, as identified by specific file names or internal script block strings.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Page 56 of 160