Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by invoking memory manipulation techniques. The rule monitors for the usage of 'VirtualProtect', 'GetProcAddress', and 'LoadLibrary' in combination with AMSI-specific strings (e.g., 'AmsiScanBuffer', 'amsi.dll') and the .NET 'Runtime.InteropServices.Marshal' namespace, which are indicative of an in-memory AMSI patch or obfuscation.
Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects suspicious PowerShell execution patterns involving dynamic command reconstruction using [char[]] character arrays and the iex (Invoke-Expression) cmdlet, or the use of specific base64 EncodedCommand prefixes associated with known obfuscation tools like Banana RAT.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects anomalous process execution chains where Fortinet FortiClient scheduler processes (scheduler.exe or FortiTray.exe) spawn cmd.exe to execute command scripts, or subsequently spawn PowerShell with obfuscated command line arguments (-enc, -EncodedCommand) and hidden window flags (-w 1), as identified in the FortiBleed campaign.
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
Detects the execution of PowerShell with typical reverse shell command-line flags (-nop, -w hidden, -c) launched as a child process of cmd.exe. This pattern is commonly associated with remote code execution (RCE) scenarios, such as the exploitation of vulnerable applications that inject keystrokes or system commands via unauthenticated interfaces.
Detects the execution of PowerShell commands that attempt to open or process a specific suspicious PDF file named 'Rate_Confirmation_LD-2026-0847.pdf' located in user download directories. This pattern is often indicative of social engineering attempts where a user is tricked into opening a malicious file.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.
Detects the use of PowerShell Get-ADComputer cmdlet with wildcard filters combined with parameters like -Server or -Properties, or redirects to CSV files. This pattern is indicative of unauthorized discovery of domain computer objects.
Detects adversary cleanup activities where PowerShell is used to remove script files and shortcuts (.lnk, .js, .bat, .vbs) from common persistence and startup directories (APPDATA, PUBLIC, ProgramData, and Startup folder), often associated with Veil#Drop anti-forensic techniques.
This rule detects a suspicious process execution chain where the FortiClient scheduler (scheduler.exe) initiates a command-line interpreter (cmd.exe) to execute a batch file, which subsequently launches a PowerShell process with obfuscated or hidden command-line arguments (e.g., -w 1, -enc). This chain is often indicative of post-exploitation activity, specifically related to the FortiBleed vulnerability chain or the deployment of infostealers.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.
Detects suspicious PowerShell execution patterns characterized by the 'ClickFix' social engineering technique. This involves an attacker tricking a user into copying and pasting a PowerShell command into their terminal, often disguised as a fake reCAPTCHA or security verification page. The rule monitors for PowerShell processes spawned by common user-facing applications (explorer.exe, conhost.exe, WindowsTerminal.exe) that contain specific command-line arguments like 'iex(irm' or 'iex(iwr'.
Page 59 of 160