Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the ClickFix clipboard execution (Get-Clipboard or iex) triggered from explorer.exe, specifically leading to the download of the Matanbuchus DLL.
Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.
Detects PowerShell IEX download cradle used for fileless execution
This rule detects various reconnaissance techniques commonly used to identify network resources, including the execution of SoftPerfect Network Scanner (or renamed binaries), the creation of 'delete.me' files used by SoftPerfect to probe share permissions, the usage of the 'Invoke-ShareFinder' PowerShell script, and the enumeration of network shares using 'net.exe' initiated from PowerShell.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
This rule detects PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by using .NET reflection techniques. The detection monitors for common class and method names (e.g., 'AmsiUtils', 'Marshal.WriteInt64') utilized by attackers to disable or tamper with AMSI's memory structures within a running PowerShell process.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) using .NET reflection techniques. It specifically looks for patterns involving the manipulation of internal AMSI fields, such as 'AmsiUtils', 's_amsiInitFailed', and 'DynamicMethod', which are common indicators of malicious attempts to disable or evade script content analysis in memory.
Detects the execution of PowerShell processes where command lines contain references to Nishang framework scripts, 'Invoke-PowerShellTcp' reverse shell patterns, or indicators of attempts to bypass the Antimalware Scan Interface (AMSI) such as 'AmsiScanBuffer' or 'amsiInitFailed'.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).
Detects a suspicious execution chain where a command prompt (cmd.exe) launched from a Startup LNK context initiates a hidden PowerShell process with Execution Policy bypass flags. This pattern is often associated with fileless malware execution, specifically linked to UAC-0226 activity, aiming to execute obfuscated PowerShell scripts by reading payloads from memory or staged files.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common reflection-based patterns, such as accessing 'AmsiUtils', modifying 'amsiInitFailed' flags, or using 'BindingFlags' to manipulate non-public members. These techniques are commonly used to disable AMSI scanning within a malicious PowerShell script's memory space.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
This rule detects PowerShell script block execution containing indicators commonly associated with JIT heap memory manipulation and AMSI bypass techniques. It uses a scoring system based on the presence of specific .NET classes and methods used to allocate, copy, and change protection on memory pages, which are typical of fileless payload execution and security feature subversion.
Page 87 of 160