Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects execution of PowerShell commands associated with the Pay2Key ransomware, specifically searching for command lines that reference bin-staged payloads (data1.bin, data2.bin, data3.bin) and a hardcoded XOR key (12199) used to deobfuscate the payloads in memory before execution via Invoke-Expression or similar methods.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects the use of PowerShell to silently download and install a Remote Monitoring and Management (RMM) tool, identified by common RMM executable names and silent installation parameters.
Detects SystemBC (Coroxy) malware attempting to establish persistence by writing to Windows Registry Run or RunOnce keys. The rule specifically monitors for registry value names associated with 'socks5' proxy functionality, the presence of 'stmbc.exe' in registry data, or hidden PowerShell command strings often used by the malware for execution.
Detects the execution of command-line shells (powershell.exe or cmd.exe) spawned by processes that are typically associated with system services or security products (e.g., svchost.exe, MsEdgeUpdate.exe), where the parent process is not located in the standard Windows System32 directory. This pattern often indicates attempts to bypass security controls or masquerading by malicious actors to achieve code execution.
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Specifically flags Invoke-WebRequest being launched directly from the Explorer shell context, bypassing normal script delivery to pull the Potemkin loader.
Detects post-execution cleanup activities associated with Yuta/Glove stealer, including the deletion of files in PyInstaller temp directories (_MEI*), temporary paths, and the removal of specific stealer components (e.g., YutaCore.dll, SLaunch.exe) via command-line utilities like cmd.exe or PowerShell.
This rule detects potential tunnel creation using PowerShell. It identifies network connections from PowerShell processes to common SSH (22) or Tor (9001, 9050) ports, as well as PowerShell script block activity involving socket connections directed at .onion domains, SSH keys, or authorized keys files, which may indicate remote access tunneling or command-and-control communication.
This rule identifies instances of PowerShell executing with an encoded command followed immediately (within 300 seconds) by an outbound network connection to a non-standard port or non-internal IP address. This behavior is indicative of a remote access tool or reverse shell establishing command and control (C2) communication.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects the execution of PowerShell with the EncodedCommand (-enc/-e/-ec) argument, which is frequently used by adversaries to hide malicious scripts and bypass simple command-line inspection. The rule excludes processes signed by Microsoft to reduce noise from legitimate system administration scripts.
Detects modifications to Windows Run or RunOnce registry keys by PowerShell or Reg.exe processes, specifically when originating from the WinGet DSC (Desired State Configuration) stack. The rule flags entries where the registry value points to potentially sensitive/user-writable directories or contains evidence of encoded command execution (e.g., PowerShell base64 encoding or common obfuscated syntax).
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.
Detects instances where wscript.exe or cscript.exe spawn a hidden PowerShell process that includes '-decode' arguments targeting files within the C:\ProgramData directory. This pattern is characteristic of the Kimsuky threat group, specifically the NUKESPED JSE loader, which uses Windows Script Host to execute staged, base64-encoded payloads.
Page 66 of 160