Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects host-based reconnaissance activity patterns indicative of Trickbot malware. The rule monitors for a high frequency (>= 4 unique commands within a 30-minute window) of diagnostic commands ('tasklist', 'systeminfo', 'ipconfig', 'net') executed by cmd.exe or powershell.exe, which is a common behavior pattern for adversary discovery processes.
Detects the execution of PowerShell with the '-ExecutionPolicy Bypass' flag to interact with BitLocker-related cmdlets (Suspend-BitLocker or Get-BitLockerVolume). This pattern is often associated with adversary attempts to weaken or assess disk encryption protections, a technique commonly used by ransomware actors.
Detects the execution of PowerShell commands intended to suspend BitLocker protection on system volumes. This behavior is indicative of VILE ransomware attempting to disable volume encryption to facilitate further malicious activity or file encryption.
Detects Pay2Key ransomware's polyglot technique where a Batch script (e.g., setup.cmd) invokes PowerShell to read its own content and execute it in-memory via Invoke-Expression (IEX). This includes detection of 64-bit PowerShell invocation from 32-bit processes using Sysnative and command-line patterns indicative of self-referencing fileless execution.
This rule detects potential persistence mechanism installation by monitoring the creation of registry values in 'Run' or 'RunOnce' keys, followed by the execution of 'powershell.exe' or 'wscript.exe' on the same host within a 5-minute window.
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
Correlates a spoofed internal email delivering an attachment that subsequently launches PowerShell on the endpoint. Specifically, it looks for emails where the sender's domain is 'yourcompany.com' but SPF authentication fails, and then links this to a device where 'powershell.exe' is executed with specific command-line arguments indicative of web requests or encoded commands.
Detects instances where common productivity applications (such as Microsoft Office suite, Outlook, or script engines like mshta/wscript) spawn PowerShell or PowerShell Core. The rule specifically looks for suspicious command line arguments often associated with malicious payloads, such as encoded commands, download instructions, or specific indicators related to Ptero-family malware.
Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Detects persistence mechanisms associated with the Gamaredon Group (also known as Shuckworm/ACTINIUM) involving the Ptero-family of malware. The rule identifies suspicious combinations of encoded PowerShell commands (using -EncodedCommand, IEX, or FromBase64String), registry modification to Windows Run/RunOnce keys referencing suspicious interpreters (wscript, mshta, powershell, rundll32) within user profile paths, and command-line indicators of C2 activity such as DownloadString/WebClient or specific .ru/.online domain patterns.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Correlates WScript execution terminating early if analysis environments are detected, before transitioning to PowerShell. This rule identifies a pattern where 'wscript.exe' executes and is quickly followed by 'powershell.exe' within a two-minute window, suggesting a potential anti-analysis technique used by malware like Vidar to evade detection in sandboxed environments.
Identifies the BackgroundFix script invoking hidden PowerShell instances to retrieve updated payloads or auxiliary modules from the C2.
This rule detects the use of common command-line utilities such as curl, certutil, and PowerShell to download files from a specific external domain ('thomphon.com') or to download a file named 'update.msi'. These activities are often associated with the staging of malicious payloads.
Detects the Prinz Eugen ransomware operator leveraging RemotePC's RPCCMDHOST.EXE to spawn PowerShell with hidden window, no profile, and non-interactive flags, consistent with obfuscated stager execution observed in active intrusions.
Page 81 of 160