Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects the execution of a malicious PowerShell loader associated with the UAC-0226 threat actor. The loader employs a 60-second sleep delay using the Start-Sleep cmdlet to evade automated sandbox analysis before proceeding to reflectively load the GIFTEDCROOK payload from a file located in C:\ProgramData\WC3.
Detects the use of System.Reflection.Emit.DynamicMethod and ILGenerator in PowerShell 7 scripts to perform an AMSI bypass. The attack works by emitting IL opcodes to directly modify the internal 's_amsiInitFailed' field within the AmsiUtils class, bypassing the initonly constraint to disable AMSI scanning.
This rule detects the execution of script files (.vbs, .ps1, .hta, .lnk, .exe) from potential removable media drives (drive letters D-Z) by common Windows interpreters (wscript.exe, cscript.exe, powershell.exe). It monitors for these processes being launched either as standalone processes or as children of other scripts, explorer.exe, or interpreters, while explicitly excluding paths typically associated with legitimate Windows system and program directories.
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or PowerShell's 'Register-ScheduledTask' cmdlet. The detection focuses on command lines that include indicators of suspicious activity, such as encoded commands, hidden window styles, or placement in temporary or application data directories, specifically when the initiating process is not a signed Microsoft binary.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) containing command line arguments indicative of malicious activity, including encoded commands, memory loading, assembly loading, thread creation, or attempts to bypass AMSI (Antimalware Scan Interface). The rule specifically excludes processes signed by Microsoft to reduce false positives.
Detects the execution of PowerShell or pwsh that originates from an interactive parent process like explorer.exe or cmd.exe. The rule identifies suspicious command-line patterns containing 'IEX', 'Invoke-Expression', 'Invoke-WebRequest', 'iwr', or 'IRm', while excluding encoded commands, which is indicative of potential malicious clipboard-paste activity or manual attacker intervention.
Detects the creation of Windows Scheduled Tasks using either 'schtasks.exe' or 'powershell.exe' (via 'Register-ScheduledTask') with specific persistence flags, such as 'ONLOGON', 'ONSTART', 'SYSTEM' privileges, or 'HighestAvailable' execution levels. This behavior is commonly used by adversaries for persistence or privilege escalation.
Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
Detects the execution of PowerShell via WScript or CScript (ActiveX Scripting hosts) where the PowerShell command line includes suspicious arguments typically used for obfuscation, bypassing security policies, or launching payloads from the ProgramData directory.
Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Page 69 of 160