Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of known Active Directory enumeration tools (BloodHound/SharpHound, AdFind) and command-line techniques (net group /domain, PowerView cmdlets) that are frequently associated with reconnaissance activities by threat actors like Akira affiliates, particularly when initiated from non-standard or unmanaged endpoints.
Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.
Detects malicious PowerShell activity associated with the Gamaredon group, specifically targeting obfuscated command lines used for HTML smuggling and downloader execution. This rule monitors for combined Base64 and HTML entity decoding, .NET reflection-based assembly loading, suspicious mshta.exe spawning PowerShell, and PowerShell creating HTML files.
Detects the creation of potentially malicious executable or script files (.exe, .lnk, .vbs, .ps1, .hta) or autorun.inf files on removable drives (D-Z) initiated by common script interpreters or suspicious processes. This activity is then correlated with prior detections of Gamaredon (ACTINIUM/Primitive Bear) implant activity, such as Ptero-family malware, specific obfuscated PowerShell patterns, or HTML smuggling delivery via mail/Office clients on the same host within a 24-hour window.
Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.
Detects execution of PowerShell processes spawned by script hosts (wscript.exe, mshta.exe) with common bypass/encoded flags. The rule identifies suspicious command-line patterns involving known malicious infrastructure domains or specific suspected payload filenames, indicative of the Millenium RAT dropper activity.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
Detects execution of PowerShell commands indicative of Gamaredon (Shuckworm) threat group activity. The rule monitors for PowerShell processes utilizing command-line arguments typical of their 2025 downloader toolset (such as PteroPaste, PteroDee, and PteroCache), specifically combining encoded commands, in-memory execution (IEX/Invoke-Expression), and remote file fetching (DownloadString).
Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Detects the execution of PowerShell via explorer.exe containing a long Base64-encoded command string, which is characteristic of the Potemkin Loader used in ClickFix-style attacks to evade detection.
This rule correlates suspicious process initiation originating from common web browsers or document handlers (e.g., encoded PowerShell, obfuscated CMD) with subsequent high-impact activities such as QEMU emulator launch, local account creation, DLL side-loading, volume shadow copy deletion, or creation of ransom-related files. This detection follows a multi-stage logic to identify potentially advanced threats or ransomware precursors within a 4-hour window.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects reconnaissance activity associated with Akira ransomware, including PowerShell-based share enumeration (Invoke-ShareFinder, Get-NetShare), execution of unauthorized network scanning tools (e.g., SoftPerfect NetScan from non-standard paths), and the use of 'net view /domain' commands to identify accessible network resources.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.
Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
Page 68 of 160