Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Identifies PowerShell executing scripts or expressions from the ProgramData directory, which may indicate malicious staging or backdoor execution. This rule specifically looks for PowerShell processes where the command line includes 'C:\ProgramData\' and also contains keywords like 'IEX', 'Invoke-Expression', or '.ps1', suggesting the execution of a script or expression.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects a high volume of PowerShell or Command Prompt executions from a single computer by a single account within a one-hour window. This behavior can be indicative of an APT-style multi-stage attack pattern where an adversary is executing numerous commands in quick succession, potentially for discovery, execution, or privilege escalation. The rule specifically looks for command lines containing 'powershell' and '-enc' (encoded command) or 'cmd' and '/c' (execute command and terminate).
Detects the execution of PowerShell with the EncodedCommand (-enc/-e/-ec) argument, which is frequently used by adversaries to hide malicious scripts and bypass simple command-line inspection. The rule excludes processes signed by Microsoft to reduce noise from legitimate system administration scripts.
This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.
Detects the creation of new services or modification of service configurations using command-line tools (sc.exe, PowerShell) spawned by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. This activity is indicative of potential privilege escalation or persistence mechanisms being established under the context of legitimate Windows components.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects persistence establishment via the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine. The rule identifies instances where 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe' spawns 'schtasks.exe' or uses PowerShell to create scheduled tasks. It correlates process execution events with Security Event ID 4698 to identify unauthorized scheduled task creation within the WinGet DSC context.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
This rule detects potential malicious activity characterized by a high volume of file write operations (at least 20 within a 30-minute window) followed by an attempt to delete those files or the files themselves. The rule monitors Sysmon events, specifically looking for processes that exhibit significant write behavior and then initiate a deletion command via cmd.exe, PowerShell, or the native Windows MoveFileEx self-deletion mechanism.
Detects instances where wscript.exe or cscript.exe (commonly used to execute JSE files) spawns powershell.exe with command-line arguments indicative of the Kimsuky NUKESPED malware loader. The detection specifically looks for the combination of hidden window, base64 decoding flags, and execution from or manipulation of paths within C:\ProgramData.
Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.
Detects the creation or modification of Windows services using sc.exe or PowerShell New-Service where the binary path points to suspicious user-writable directories such as Temp or AppData, a technique observed in the Red Lamassu JFMBackdoor infection chain.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Detects malicious dropper behavior involving batch files spawning hidden PowerShell processes to download components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) to temporary directories. The rule further tracks the execution of the dropped fltMC.exe and the creation of the associated DLL/binary files, which is indicative of JFMBackdoor DLL side-loading.
Detects PowerShell activating the internal Store install-control class required for UnCanny coercion. This technique is associated with the UnCanny coercion method, which leverages a COM object to achieve privilege escalation or other malicious activities.
Detects the execution of PowerShell via Command Prompt (cmd.exe) using hidden window arguments to download files from external sources or temporary directories, often associated with stages of malware delivery or post-exploitation activity.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Page 83 of 160