Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell executing Base64-encoded commands, often used by malware like Potemkin Loader (ClickFix payload), to evade basic string matching. The detection specifically looks for PowerShell processes initiated by explorer.exe with a command line containing a Base64-encoded string.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window style, or specific payload strings like 'MiniJunk') originating from common file staging directories (e.g., Downloads, Temp, AppData). This pattern is often indicative of malicious post-lure payload execution.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by utilizing .NET reflection and IL generation. This technique involves creating dynamic methods and emitting instructions to manipulate the memory space of AmsiUtils, effectively disabling or blinding AMSI during script execution.
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
Detects malicious activity associated with the Yuta/Glove Stealer malware family. The rule identifies attempts to register persistent WMI event subscriptions (using wmic, powershell, or pwsh) to trigger execution or the registration of low-level keyboard hooks (WH_KEYBOARD_LL) for keylogging, originating from suspicious process paths like winupdate.exe or PyInstaller-compiled temporary directories.
Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.
Detects instances where Windows Package Manager (winget.exe) or its associated host processes (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe) spawn PowerShell. This behavior is monitored for suspicious indicators such as the use of Desired State Configuration (DSC) modules or specific command-line flags (EncodedCommand, NonInteractive, NoProfile) which may indicate malicious activity attempting to masquerade as legitimate package management operations.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
Detects the execution of PowerShell with encoded commands initiated by common Windows script hosting utilities (mshta.exe, wscript.exe, or cscript.exe). This pattern is frequently used by adversaries to bypass execution policy restrictions or evade detection by proxying the execution of malicious payloads through legitimate, signed system binaries.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
This rule detects attempts to enumerate Active Directory domain trust relationships using common administrative tools. It identifies the execution of 'nltest.exe' with trust-related arguments ('/domain_trusts', '/trusted_domains', '/all_trusts', '/dclist:') and the usage of PowerShell cmdlets or commands ('Get-ADTrust', 'netdom query trust', or Active Directory domain queries) known for querying domain trust configurations. Adversaries often perform this discovery to map out Windows multi-domain or forest environments to identify lateral movement opportunities.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.
Page 63 of 160