Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Detects PowerShell scripts containing logic indicative of extracting payloads hidden via steganography (e.g., LSB or channel-based extraction from pixel data) combined with memory-based decryption. This behavior is commonly associated with stealthy malware loaders attempting to reconstruct malicious code from image files.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects the execution of PowerShell (powershell.exe) spawned by the Windows Command Shell (cmd.exe) where the command originated from user-writable directories such as Downloads, Temp, or AppData\Local\Temp. This pattern is commonly associated with the execution of downloaded payloads or malicious scripts.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects the creation of a scheduled task via PowerShell using 'Register-ScheduledTask' configured to run as the SYSTEM account at system startup. The detection specifically identifies tasks with dynamically generated hexadecimal names (8-20 characters), a technique associated with the persistence mechanism of Banana RAT.
Page 57 of 160