Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Detects PowerShell scripts attempting to tamper with or bypass the Antimalware Scan Interface (AMSI) by reflecting on the 'AmsiUtils' class within the 'System.Management.Automation' assembly. This activity is a common technique used by adversaries to execute malicious scripts without security product intervention.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects the use of System.Reflection.Emit.DynamicMethod in PowerShell to dynamically compile and execute Intermediate Language (IL) code. This technique is commonly used to patch AMSI internals, specifically by modifying 's_amsiInitFailed' to bypass scanning capabilities.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.
Detects sophisticated AMSI bypass attempts in PowerShell sessions. The rule monitors for a combination of techniques, including patching the 'InternalNotify' function in the AMSI vtable using 'VirtualProtect', and leveraging 'Marshal.WriteInt64' to nullify critical security scan paths ('WinScanContent' and 'WinReportContent') in memory.
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by manipulating memory structures or using reflection to nullify security checks. The rule looks for signatures of commonly used bypass techniques, such as using Marshal to overwrite amsiContext, calling GetDelegateForFunctionPointer with null/IntPtr.Zero arguments to target AmsiInitialize/AmsiScanBuffer, or declaring unusual DllImport signatures for amsi.dll functions within PowerShell script blocks.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 5.1 by using .NET reflection to manipulate the 'amsiInitFailed' field within the 'AmsiUtils' class. The rule monitors both script block logs and command-line arguments for patterns involving reflective field access, string concatenation of sensitive keywords, and reflection binding flags.
Detects attempts to patch AMSI (Antimalware Scan Interface) managed methods in PowerShell memory using JIT (Just-In-Time) compilation and memory write operations. The rule identifies suspicious combinations of terms related to method preparation, memory manipulation (via System.Runtime.InteropServices.Marshal), and direct references to AMSI components within PowerShell Script Block logs (Event ID 4104).
Hunts for custom PowerShell RC4 decryption routines utilizing hardcoded byte arrays to unhook AMSI or decode subsequent stages. This rule specifically looks for PowerShell command text containing patterns indicative of byte array assignments (e.g., `]$var = 0x...`) and the `bxor` operator, which is commonly used in RC4 decryption routines.
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
This rule detects a multi-stage execution chain indicative of malicious LNK files placed in startup folders. It tracks the sequence starting with explorer.exe spawning cmd.exe (with /min switch), followed by a child powershell.exe utilizing common evasion flags, and concluding with a grandchild powershell.exe executing suspicious commands such as encoded commands, IEX, or referencing the ProgramData directory, all within a 10-minute window.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) following the reconnaissance of security software or AMSI providers. It correlates WMI or registry-based discovery activities concerning security products or AMSI configurations with subsequent PowerShell-based AMSI bypass indicators (such as specific strings or method names indicative of memory patching) occurring on the same host within a 10-minute window.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
This rule detects potentially malicious PowerShell behavior by correlating two events within a 5-minute window: first, a PowerShell process reading files from the C:\ProgramData directory, and second, the same process invoking sensitive memory manipulation APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx, GetDelegateForFunctionPointer). This pattern is commonly associated with fileless malware loaders or staging scripts that read encrypted payloads from disk and execute them in memory.
Page 88 of 160