Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the RemotePC RMM component (rpccmdhost.exe) being used to spawn PowerShell processes with suspicious command-line arguments. The rule specifically looks for evidence of hidden PowerShell execution designed to bypass TLS certificate validation and download external scripts or stagers from a known C2 IP address associated with ROOTBOY activity.
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Detects high-frequency reconnaissance activity on endpoints involving process enumeration and file/directory discovery. This behavior is commonly observed in the pre-ransomware phase as adversaries map out the environment, and is consistent with TTPs employed by threat actors such as BlackBasta, including the use of native administrative tools (e.g., tasklist, dir, tree, net share) and PowerShell commands for discovery.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
This rule detects instances where Microsoft Management Console (mmc.exe) spawns a hidden PowerShell process that attempts to execute commands using 'IEX' (Invoke-Expression) combined with 'DownloadString' or 'Net.WebClient'. This pattern is commonly associated with malicious activity, such as downloading and executing payloads from a remote source, often to evade detection.
Detects PowerShell executing 'Add-AppxPackage -Register' with a UNC path, which is a core primitive of the UNCanny InstallService coercion attack. This indicates an attempt to register a loose-file AppX package from a network share.
Detects modification or creation of Windows Registry Run keys by non-Microsoft signed instances of reg.exe, powershell.exe, or pwsh.exe. This activity is a common method for achieving persistence by ensuring malicious code executes automatically upon user login.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Page 84 of 160