Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Detects suspicious PowerShell activity characteristic of the ScreenConnect AsyncRAT campaign, specifically the use of Add-MpPreference to add Windows Defender exclusions for RegAsm.exe and drive roots, and the modification of ConsentPromptBehaviorAdmin to suppress UAC prompts. These actions facilitate process hollowing and malware execution with elevated privileges.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects instances where PowerShell is spawned by cmd.exe and includes command-line arguments indicative of a reverse shell, such as network socket creation, hidden execution, or encoded commands. This pattern often follows suspicious parent processes or activities such as keystroke injection.
This rule detects a sequence of events where a host initiates a network connection on port 1313 (a common port associated with certain web-based C2 or exploitation frameworks) followed shortly by an outbound network connection initiated by PowerShell within a 5-minute window. This behavior is indicative of a post-exploitation phase where an initial entry point leverages a malicious script or shell to establish persistent communication.
Detects instances where the WinRAR archive utility spawns a PowerShell process with command-line arguments typically associated with obfuscated or fileless execution. The detection specifically flags PowerShell commands that employ techniques such as base64 encoding, execution policy bypass, hidden window styles, or commands containing indicators of in-memory process manipulation such as NtAllocateVirtualMemory or memory allocation constants.
Detects the use of PowerShell to read files from the C:\ProgramData directory using the -Raw parameter, followed by the execution of the content via Invoke-Expression (iex). This pattern is often used to execute obfuscated payloads stored in non-standard locations while bypassing basic execution constraints.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
Detects the use of PowerShell .NET reflection to access non-public static fields within the System.Management.Automation.AmsiUtils class. Attackers often target fields such as 'amsiInitFailed' or 's_amsiContext' to programmatically disable or bypass Antimalware Scan Interface (AMSI) inspection during script execution.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
This rule detects attempts to clear Windows Event Logs using either 'wevtutil.exe', PowerShell 'Clear-EventLog' command, or by monitoring specific Windows Event IDs (1102 and 104) which indicate logs have been cleared. Clearing event logs is a common technique used by attackers to hide malicious activity and evade detection.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding an exclusion path. This activity is commonly used by adversaries to prevent security software from scanning specific directories where malicious tools or payloads are staged.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
Page 65 of 160