Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
This detection identifies a pattern associated with the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
This rule detects the use of native Windows utilities such as nltest.exe, netdom.exe, and PowerShell to enumerate Active Directory domain trust relationships. Attackers commonly perform this discovery to map out target environments, identify lateral movement opportunities, or plan further exploitation in multi-domain or forest environments.
This rule detects potential Active Directory enumeration attempts by monitoring for the execution of common command-line tools and PowerShell cmdlets used to query domain information, such as users, groups, and domain controllers.
Detects the execution of PowerShell commands used to initiate remote sessions (e.g., New-PSSession, Invoke-Command) targeting specific remote hosts, excluding localhost connections and common system processes. This behavior is often associated with lateral movement or remote administration activities.
This rule detects potentially malicious activity within Azure Automation by monitoring for the creation or modification of runbooks and jobs, combined with the presence of suspicious command-line or script patterns in job stream output, such as credential harvesting (e.g., Get-AutomationPSCredential) or execution of web-based payloads (e.g., IEX, Invoke-WebRequest).
Detects the use of common PowerShell cmdlets often associated with fileless malware execution, such as 'Invoke-Expression', 'IEX', or 'DownloadString', initiated by 'powershell.exe'. These patterns are frequently used to download and execute malicious payloads directly in memory, bypassing traditional disk-based scanning.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. Specifically, it looks for PowerShell command or script block execution events containing the string patterns "-bxor[int][char]$" and "[convert]::ToInt32", which are indicative of the custom XOR decryption and type conversion methods employed by this malware distribution framework.
Detects the initial ClickFix mechanism where a user is socially engineered into pasting a malicious script (Get-Clipboard) into the Run dialog (explorer.exe), which launches PowerShell to fetch the CastleLoader.
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a suspicious C2 domain (hellolargeworld.com) or invocation method (Extension.SubRoutine.Run2).
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Detects instances where PowerShell is spawned directly from Microsoft Teams processes or via explorer.exe shortly after receiving an external chat message in Teams. This pattern is often associated with social engineering lures, such as the 'paste-and-run' attack chain used to facilitate malicious activity.
Detects the execution of PowerShell commands that bypass execution policies to specifically disable or suspend BitLocker protection. This behavior is often associated with ransomware or malicious actors attempting to circumvent full-disk encryption to facilitate data manipulation or destruction.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Detects execution chains where Outlook launches a VBScript file that subsequently invokes PowerShell with encoded commands, characteristic of Gamaredon (ACTINIUM) threat activity. Additionally, it identifies the creation of VBScript/VBE files in temporary directories, which is consistent with the deployment of PteroVDoor or PteroPSDoor loaders.
This rule detects PowerShell activity where commands are used to perform reconnaissance (e.g., whoami, ipconfig, or network group enumeration) and the output is exfiltrated or sent via a POST request to a specific external IP address (202.182.102.5).
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Page 73 of 160