Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.
Detects anomalous PowerShell process execution by monitoring for indicators of obfuscation, use of download cradles, and execution from suspicious parent processes. This detection specifically aligns with techniques associated with the Millenium RAT C++ v4.x stagers, flagging processes that exhibit multiple risk indicators simultaneously.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects PowerShell-based malware stagers used by ErrTraffic ClickFix campaigns that download and execute second-stage payloads using encoded commands and common download cradles. It also detects certutil.exe used for decoding.
Detects the execution of PowerShell with suspicious command-line arguments, including obfuscation techniques like base64 encoding, attempts to hide the console window, and strings associated with Pterodo-related tools or backdoors.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
Detects sandbox evasion techniques used by the Gamaredon group's PteroSand malware. The rule monitors for WMI queries against system artifacts (Win32_ComputerSystem, Win32_BIOS, or Win32_VideoController) searching for virtualization-related strings (vmware, vbox, etc.), followed by a mandatory sleep/timeout delay of at least 60 seconds, and concludes by identifying the subsequent execution of a new process within the same lineage.
Detects the execution of PowerShell with encoded commands initiated by common office applications (e.g., WinWord, Excel) or scripting engines (e.g., wscript, mshta). The rule specifically targets command lines longer than 200 characters that are not digitally signed by Microsoft, often indicating obfuscated malicious payloads intended to evade detection.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
This rule detects potential data exfiltration activity where PowerShell is used to compress files followed by an outbound network connection to a known C2 IP address and port. It also monitors for direct outbound connections from PowerShell involving suspicious keywords indicative of data staging and exfiltration such as 'Compress-Archive', 'client.zip', and 'UPLOAD'.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Page 77 of 160