Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Unrestricted) originating from the ScreenConnect SystemTemp directory. This behavior is consistent with malicious campaigns, such as those deploying AsyncRAT via trojanized installers, that utilize the ScreenConnect temporary storage path to stage and execute secondary malicious payloads.
This rule detects potential exploitation of vulnerabilities (such as CVE-2026-33017) where mshta.exe or wscript.exe spawns PowerShell, followed by the addition of a persistent entry to the HKCU Run registry key targeting Node.js or JavaScript files.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
Detects a suspicious process execution chain where explorer.exe or userinit.exe spawns cmd.exe, which in turn launches PowerShell to execute a hidden, bypassed, and obfuscated script involving content retrieval from the C:\ProgramData directory. This pattern is characteristic of the UAC-0226 GIFTEDCROOK actor's persistence mechanism using LNK files.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.
This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects the use of .NET reflection within PowerShell to access the 'AmsiUtils' class and set the 'amsiInitFailed' field to true. This technique effectively disables the Antimalware Scan Interface (AMSI) for the current PowerShell process, allowing subsequent malicious code or scripts to execute without being scanned for threats.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell Cmdlets, or WMI providers. These actions are common techniques for attackers to impair system defenses and remove evidence of their activities from a compromised host.
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
Detects the creation or modification of inbox rules via PowerShell, specifically targeting cmdlets commonly used by attackers to hide phishing indicator emails, security alerts, or C2 communications by moving or deleting them into folders like Junk, Deleted Items, or Archive. The rule monitors for both direct usage on the endpoint and remote administration patterns via Exchange Online/EWS remoting.
Page 62 of 160