Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell to manually modify file system timestamps (CreationTime, LastWriteTime, LastAccessTime) on ASPX files or within common web-accessible directories. This technique is often used by adversaries to hide the true creation or modification time of webshells, facilitating anti-forensic activities and timeline corruption.
Detects ClickFix attack patterns where users are coerced into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The command uses clipboard access (Get-Clipboard) or network download/execution (iwr, iex) methods, commonly associated with the Potemkin Loader or RMM-based distribution campaigns.
Detects the use of .NET reflection within PowerShell to resolve and invoke native Windows APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx) typically used by the GIFTEDCROOK actor to perform in-memory shellcode or PE loading. The rule searches for command line patterns combining native API names with reflection-related keywords.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
Detects ClickFix-style attacks where users are social-engineered into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The rule specifically monitors for powershell.exe being initiated by explorer.exe with command-line arguments involving clipboard access (Get-Clipboard) or web-based script retrieval/execution (iwr, iex).
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
This rule detects attempts by the PowerShell process to bypass the Antimalware Scan Interface (AMSI) by patching the amsi.dll in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events targeting 'powershell.exe' where 'amsi.dll' has been loaded into the process's memory space. This technique is often used by malware, such as Potemkin Loader, to evade detection.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.
This rule detects potentially malicious activity related to Group Policy Object (GPO) manipulation, including the execution of the SharpGPOAbuse tool and suspicious PowerShell commands intended to modify GPOs for persistence or privilege escalation, such as adding local administrators, creating immediate tasks, or applying domain-level policies.
This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.
Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.
This rule detects attempts to enumerate Active Directory domain trust relationships using common administrative tools. It identifies the execution of 'nltest.exe' with trust-related arguments ('/domain_trusts', '/trusted_domains', '/all_trusts', '/dclist:') and the usage of PowerShell cmdlets or commands ('Get-ADTrust', 'netdom query trust', or Active Directory domain queries) known for querying domain trust configurations. Adversaries often perform this discovery to map out Windows multi-domain or forest environments to identify lateral movement opportunities.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) of a malicious script behind the Get-Alias or Get-Command cmdlet shortcuts (gal/gcm).
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Correlates the ClickFix PowerShell execution with the dropping of the Potemkin loader executable and its associated configuration files into the AppData folder.
Detects two distinct malicious PowerShell behaviors: memory-resident script execution using Base64 and XOR obfuscation, and unauthorized modification of Windows Defender preferences to add exclusions.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Page 64 of 160