Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell or PWSH where the command line contains common environment variables and paths associated with the Windows Startup folder. This pattern is commonly used by adversaries to achieve persistence, ensuring malicious scripts execute upon user login.
This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
Detects the execution of PowerShell commands that exhibit characteristics of reverse shells, such as the use of Nishang or Invoke-PowerShellTcp scripts, or the combination of web-download commands with expression evaluation. The rule also calculates a risk score based on the presence of common AMSI bypass flags (e.g., hidden windows, execution policy overrides) and specific reverse shell indicators.
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects command and control (C2) activity attributed to threat actor UAC-0226 by monitoring for direct network connections to known hardcoded C2 IP addresses from suspicious process paths or PowerShell, and by identifying beaconing patterns (regular HTTPS intervals) originating from non-browser processes in sensitive locations like ProgramData or AppData/Local/Temp.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
Detects instances of PowerShell executing Base64-encoded commands initiated by Windows Explorer, a common technique used in the Potemkin Loader/ClickFix campaign to evade static analysis and security controls.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
Detects PowerShell execution initiated by explorer.exe that explicitly uses the '-WindowStyle Hidden' parameter, a technique observed with the Potemkin loader to mask its execution.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.
Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.
Page 67 of 160