Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
This rule detects instances where PowerShell or PowerShell Core (pwsh.exe) are spawned as child processes of common COM object host processes (e.g., wscript.exe, mshta.exe, rundll32.exe). The detection specifically looks for command-line arguments containing encoded commands or indicators of download cradles (e.g., IEX, Net.WebClient, DownloadString), which are common patterns for fileless execution and malicious script staging.
This rule detects the execution of common network share enumeration tools or scripts, specifically looking for the execution of netscan.exe (or similar) or PowerShell commands utilizing common share finding utilities like Invoke-ShareFinder, CheckShareAccess, or commands exporting share information to files.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
This rule detects a remote interactive logon (Logon Type 10) via RDP, followed by a PowerShell process executing 'net.exe' with sensitive administrative arguments such as 'administrator', '/active:yes', or '/dom'. This pattern is highly indicative of an adversary attempting to elevate privileges or modify domain/local account properties after establishing initial access via Remote Desktop.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects the execution of PowerShell with an encoded command flag when spawned directly from explorer.exe or cmd.exe. This pattern is frequently used in 'ClickFix' style attacks where users are tricked into copying and pasting malicious, obfuscated PowerShell code into the Windows run dialog or command prompt.
Detects the execution of PowerShell with an encoded command flag when spawned directly from explorer.exe or cmd.exe. This pattern is frequently used in 'ClickFix' style attacks where users are tricked into copying and pasting malicious, obfuscated PowerShell code into the Windows run dialog or command prompt.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects PowerShell executing a reflective .NET assembly load, indicated by keywords like 'Reflection.Assembly', 'Load', and 'byte' in the command line. The detection is further refined by looking for 'Extension.SubRoutine', 'Run2', or the C2 domain 'hellolargeworld.com' in the command line, and specifically targets instances where the initiating process is 'node.exe'. This behavior is indicative of the 'protocal.cjs' backdoor.
This rule detects suspicious PowerShell script behavior that attempts to patch the Anti-Malware Scan Interface (AMSI) in-memory by manipulating internal .NET/CLR methods. It identifies the combination of dangerous API calls (e.g., VirtualProtect, Marshal.Copy, PrepareMethod) typically used to bypass AMSI scanning via JIT compilation patching targeting the WinScanContent method.
This rule detects potential attempts to disable Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 using reflection-based manipulation of the amsiInitFailed boolean field in the System.Management.Automation.AmsiUtils class. Attackers often use obfuscation techniques such as splitting strings or using reflection methods to bypass static security signatures.
Detects execution of PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by dynamically creating methods using System.Reflection.Emit. It looks for specific keywords associated with reflection-based AMSI tampering, such as creating dynamic methods, accessing internal IL generators, and explicitly targeting AMSI-related memory structures like amsiContext or s_amsiInitFailed.
This rule detects potential malicious activity involving PowerShell by correlating signs of an Antimalware Scan Interface (AMSI) bypass attempt with an subsequent network connection to an external, non-standard port. The rule monitors for common command-line patterns used to disable or impair AMSI functionality within PowerShell processes, followed by suspicious outbound network traffic from the same process within a five-minute window.
Page 72 of 160