Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects Add-AppxPackage -Register against a manifest on a UNC path. Legitimate loose-file registration during development points at local paths; a UNC InstalledLocation is the core of UNCanny - it hands the SYSTEM Windows Store InstallService a LoadLibraryW on an attacker-controlled UNC via plugin resolution.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects modification or creation of Windows Registry Run keys by non-Microsoft signed instances of reg.exe, powershell.exe, or pwsh.exe. This activity is a common method for achieving persistence by ensuring malicious code executes automatically upon user login.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
This rule detects the execution of PowerShell or pwsh.exe with an encoded command. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for the '-EncodedCommand' or '-enc' parameter followed by a base64-encoded string of at least 20 characters.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands querying registry keys related to installed software or listing applications.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects a PowerShell process initiated by node.exe that attempts to reflectively load a .NET assembly from memory. The detection specifically looks for keywords related to .NET Reflection, byte array loading, and a known C2 domain (hellolargeworld.com), along with the 'Extension.SubRoutine.Run2' invocation, indicating potential backdoor activity.
This rule detects attempts to disable PowerShell command history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle SaveNothing'. Adversaries often disable command history to evade detection and hinder forensic analysis.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
This rule detects PowerShell or pwsh processes executing commands that contain the string 'autogenstudio' combined with a base64-encoded or obfuscated command pattern. This behavior is indicative of an adversary attempting to execute obfuscated scripts or payloads associated with the Autogenstudio application or using it as a camouflage.
Detects execution of PowerShell commands that use the ExecutionPolicy Bypass flag while concurrently attempting to suspend BitLocker protection. This behavior is highly characteristic of ransomware activity, specifically associated with the ShrinkLocker malware, where the adversary disables disk encryption protection to facilitate malicious operations or subsequent encryption.
Detects the use of PowerShell to perform DNS lookups for TXT records followed by immediate command execution, such as using 'Invoke-Expression' or 'Start-Process'. This pattern is frequently indicative of fileless command-and-control (C2) communication where stage-payload commands or scripts are retrieved via DNS TXT records to evade detection.
Detects the execution of PowerShell commands intended to suspend BitLocker encryption. Adversaries may attempt to disable or suspend disk encryption to facilitate data exfiltration or to modify protected system files.
Page 75 of 160