Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell invoking Add-AppxPackage -Register with a UNC path, the initial trigger in the UNCanny attack chain. A standard user registers a loose-file AppX package from an attacker-controlled SMB share, causing the Windows Store Install Service (running as SYSTEM) to perform a LoadLibraryW call against the remote path.
This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility with the 'cl' command, the PowerShell 'Clear-EventLog' cmdlet, or by identifying specific system events (EventID 1102 and 104) that signify the security or system logs have been cleared.
Detects the execution of a PowerShell script named 'cap.ps1' using common obfuscation and evasion flags including '-windowstyle hidden' and '-executionpolicy bypass'. This pattern is frequently used by adversaries to execute malicious scripts while minimizing user visibility and bypassing standard security policy restrictions.
Detects PowerShell scripts that contain custom bit-reversal and XOR decoding routines used to deobfuscate an embedded byte blob, followed by the reflective loading of that blob into memory as a .NET assembly using [Reflection.Assembly]::Load. This behavior is associated with loaders like cap.ps1 used to deploy RATs such as AsyncRAT.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
Detects execution of PowerShell or PWSH containing multiple suspicious command line flags commonly associated with malicious scripts and evasion techniques, such as bypassing execution policies, running in hidden windows, using encoded commands, or utilizing invoke-expression.
Detects the execution of PowerShell scripts attempting an in-memory AMSI bypass by patching the AMSI scan content handler. The rule identifies suspicious combinations of .NET reflection and memory protection APIs (such as RuntimeHelpers.PrepareMethod, VirtualProtect, and Marshal.Copy) commonly utilized to overwrite AMSI function pointers or return values during runtime.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by nulling the pAppName pointer in memory using Marshal.WriteInt64. This technique forces AmsiScanBuffer and AmsiNotifyOperation to return E_INVALIDARG, causing them to fail open and skip security inspection.
Detects host-based reconnaissance activity patterns indicative of Trickbot malware. The rule monitors for a high frequency (>= 4 unique commands within a 30-minute window) of diagnostic commands ('tasklist', 'systeminfo', 'ipconfig', 'net') executed by cmd.exe or powershell.exe, which is a common behavior pattern for adversary discovery processes.
Detects instances where explorer.exe launches a PowerShell process originating from an LNK file, which then performs a remote download of a Node.js runtime and JavaScript implant (TonRAT) to standard Windows temporary or application data directories. This activity is indicative of the TonRAT campaign targeting hospitality front-desk systems.
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects powershell.exe executing a hidden .ps1 script from AppData\Local\Temp using character-code string concatenation obfuscation ([char]N+[char]N) and ForEach-Object {[char]$_} patterns, consistent with the TuglaInsaatci/Remcos steganographic loader campaign dropping pmxhtzb4w2q.ps1 for persistence.
Detects the steganographic loader campaign setting HKCU Run key persistence using powershell.exe with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File pointing to an obfuscated .ps1 script in AppData\Local\Temp, as observed in the FortiBleed/TuglaInsaatci campaign delivering Remcos RAT.
Page 78 of 160