Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects the use of PowerShell to execute WMI queries against the Win32_ComputerSystem class to identify domain membership information. This is a common discovery technique used by attackers to profile the environment and understand network context.
Detects unauthorized attempts to perform bulk enumeration of Active Directory user objects by monitoring for Get-ADUser cmdlet execution with wildcard filters. Additionally, it monitors for the creation of common output files (e.g., CSV exports) often used to store the results of such reconnaissance activities.
Detects the execution of PowerShell with a combination of flags commonly used to bypass security policies, obscure command execution, and run hidden tasks: -NoProfile, -ExecutionPolicy Bypass, and -EncodedCommand.
Detects the execution of PowerShell with a combination of flags commonly used by attackers to hide activity, bypass execution policies, and execute encoded or scripted commands. This pattern often indicates attempts to run malicious scripts stealthily on a Windows host.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.
Detects the execution of PowerShell via explorer.exe using hidden windows styles and encoded commands. This behavior is often associated with fileless execution, initial access via malicious attachments or documents, and various obfuscation techniques used by adversaries to evade detection.
Detects the use of the Get-ADReplicationSubnet PowerShell cmdlet to query Active Directory replication subnet configurations. Attackers may use this command to map the internal network topology, identify domain controllers, and scope lateral movement targets within the AD environment.
Detects attempts to discover domain controllers using various fallback techniques including nltest, PowerShell cmdlets (Get-ADDomainController), and querying the LOGONSERVER environment variable. Attackers use these methods to map network infrastructure and identify domain controllers for lateral movement or domain enumeration.
Detects the use of the PowerShell cmdlet 'Get-DnsServerResourceRecord' to enumerate DNS zone records. Attackers frequently use this technique to map out network infrastructure, identify internal assets, and discover target subnets within an Active Directory environment.
Detects the execution of the PowerShell script 'install_ad.ps1' with the '-ExecutionPolicy Bypass' flag. This pattern is commonly associated with automated software deployment scripts, such as AnyDesk, and may be used by adversaries to facilitate malicious script execution while evading security policies.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window styles, and suspicious cmdlets like IEX or WebClient) when launched from explorer.exe. This pattern is commonly associated with fileless malware execution or malicious script downloads.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the PureLog Stealer performing system and process reconnaissance using .NET capabilities reflectively loaded via PowerShell. The rule monitors for the combination of process enumeration (System.Diagnostics.Process/Win32_Process), system metadata harvesting (Environment class properties), and memory-only execution patterns (Reflection.Assembly.Load) within PowerShell script block logs.
Detects the execution of PowerShell with specific flags to bypass execution policy and hide the window, commonly used to execute encoded payloads. This rule monitors for PowerShell processes spawned by suspicious parent processes such as 'cmd.exe' or 'ElevatorShellCode.exe' that include parameters like '-ep bypass', '-w hidden', and base64-encoded strings.
Page 58 of 160