Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell to perform DNS lookups for TXT records followed by immediate command execution, such as using 'Invoke-Expression' or 'Start-Process'. This pattern is frequently indicative of fileless command-and-control (C2) communication where stage-payload commands or scripts are retrieved via DNS TXT records to evade detection.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
This rule detects potentially malicious activities related to Active Directory Certificate Services (AD CS). It identifies suspicious certificate export commands (certutil, PowerShell), non-privileged processes writing to system certificate stores, and dangerous AD CS enrollment patterns such as Subject Alternative Name (SAN) modifications, often associated with ESC1 privilege escalation techniques.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects the execution of wscript.exe spawning a child powershell.exe process with arguments specifically configured to execute a script file starting with 'ps_' from the 'C:\Temp' directory. This behavior is highly characteristic of JScript droppers commonly associated with malicious email attachments that write and launch secondary payloads silently in the background.
This rule detects PowerShell commands that perform XOR decryption of an embedded payload using the hardcoded key 'Pussecretvk456' and subsequently use [System.Reflection.Assembly]::Load to reflectively load the resulting .NET assembly into memory. This behavior is indicative of fileless execution patterns commonly observed in the LokiBot and Amadey malware families.
Detects instances where PowerShell is invoked with an execution policy bypass flag to copy the 'curl.exe' binary from its legitimate System32 location to user-writable directories (such as AppData, Temp, or Public folders) and renaming it. This activity is often associated with adversaries attempting to evade security controls by masquerading legitimate system utilities.
Detects the execution of PowerShell scripts from the Windows Temp directory using common evasion flags (-NoProfile, -ExecutionPolicy Bypass, -WindowStyle Hidden). This pattern is consistent with loaders attempting to maintain persistence while obfuscating their execution context, specifically associated with steganographic malware campaigns.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.
Detects suspicious process creations (PowerShell, Cmd, Mshta, Wscript) originating from web browsers, explorer.exe (likely from the Run dialog), or rundll32.exe. This pattern is often associated with social engineering attacks like 'ClickFix' where users are tricked into pasting malicious commands.
Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the loading of System.Management.Automation.dll by processes that are not standard PowerShell executables (powershell.exe, pwsh.exe, powershell_ise.exe). This behavior is indicative of in-process PowerShell execution, potentially leveraging techniques like SHEETCREEP's RunspaceFactory.CreateRunspace(). The rule specifically looks for processes loading this DLL from suspicious paths like AppData or if the process is 'vaultsvc.exe', and further filters out cases where a powershell.exe child process is spawned, to reduce false positives.
Page 76 of 160