Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects suspicious PowerShell execution patterns involving scripts or payloads stored within specific directory paths (ProgramData\WC3\ or ProgramData\wt1). It flags instances where PowerShell commands include reflective loading techniques ('IEX' or 'Invoke-Expression') while referencing files in these paths, which is often associated with fileless malware execution or malicious loaders.
Detects the execution of PowerShell commands used to initiate remote sessions (e.g., New-PSSession, Invoke-Command) targeting specific remote hosts, excluding localhost connections and common system processes. This behavior is often associated with lateral movement or remote administration activities.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
This rule detects potentially malicious activity within Azure Automation by monitoring for the creation or modification of runbooks and jobs, combined with the presence of suspicious command-line or script patterns in job stream output, such as credential harvesting (e.g., Get-AutomationPSCredential) or execution of web-based payloads (e.g., IEX, Invoke-WebRequest).
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, such as modifying AmsiUtils, AmsiScanBuffer, or related reflection-based obfuscation in process command lines.
This rule detects instances where PowerShell or PowerShell Core (pwsh.exe) are spawned as child processes of common COM object host processes (e.g., wscript.exe, mshta.exe, rundll32.exe). The detection specifically looks for command-line arguments containing encoded commands or indicators of download cradles (e.g., IEX, Net.WebClient, DownloadString), which are common patterns for fileless execution and malicious script staging.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects ClickFix PowerShell payloads
Identifies an interactive logon session established from a RedVDS IP executing PowerShell downloaders to pull secondary payloads. This rule correlates process execution events for PowerShell with specific command-line patterns indicative of downloading content (Net.WebClient or DownloadString) with interactive logon events originating from a known RedVDS IP address.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.
This rule detects the use of BITSAdmin and PowerShell's Start-BitsTransfer utility to download files from known malicious or suspicious GitHub repositories and specific filenames associated with campaign activity.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects execution of PowerShell scripts associated with ErrTraffic (ClickFix) campaigns. The rule identifies malicious patterns, including the use of hex-encoded XOR operations, specific browser update comment markers, and the dynamic creation of ScriptBlocks to facilitate payload execution.
Detects PowerShell commands executed by a Node.js process to gather system information, specifically targeting installed applications and packages. This could indicate malicious activity where a Node.js application or script is being used to enumerate system details.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects PowerShell execution with a highly suspicious command line containing common obfuscation techniques, the 'DownloadString' method, and a hardcoded IP address. This pattern is frequently observed in malware and adversary tooling to download and execute malicious payloads from a remote server.
Page 80 of 160