Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects common PowerShell command-line arguments and patterns used by attackers to bypass or disable Antimalware Scan Interface (AMSI) in memory. Attackers often attempt to modify non-public, static members of the AmsiUtils class to force AMSI initialization failure, allowing for the execution of malicious scripts without detection.
Detects a sequence where a command shell (cmd.exe) is launched with minimized window flags to run PowerShell, followed by a PowerShell process executing code using common file-less loading techniques, specifically using Invoke-Expression (iex) on content retrieved via Get-Content from within the ProgramData directory.
This rule detects PowerShell execution attempts that include strings associated with Anti-Malware Scan Interface (AMSI) bypass techniques. Specifically, it searches for command-line arguments that attempt to manipulate memory (VirtualProtect, Marshal.WriteByte, RtlMoveMemory) or interact with AMSI/PowerShell internals (AmsiScanBuffer, amsi.dll) commonly used to disable AMSI scanning within a running process.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
This rule detects potential malicious activity where a PowerShell process first attempts to bypass the Antimalware Scan Interface (AMSI) and subsequently executes code characteristic of a reverse shell or network-based command execution within a 10-minute window. This sequence is a common pattern for fileless malware or remote access trojans (RATs) attempting to evade detection and maintain persistence.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects PowerShell commands that intentionally disable SSL certificate validation, which can be used by attackers to bypass security controls and trust their malicious HTTPS infrastructure. This technique is often associated with the 'InstallFix' malware.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by performing in-memory patching of the AmsiScanBuffer function within amsi.dll. The rule identifies suspicious memory manipulation operations (VirtualProtect, WriteProcessMemory) performed by script hosts (PowerShell, WScript, CScript) involving PAGE_EXECUTE_READWRITE permissions or specific memory modification patterns (0xB8 opcode patching) indicative of disabling security scanning capabilities.
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Detects the execution of the Nishang 'Invoke-PowerShellTcp' reverse shell payload via PowerShell. This rule monitors for common obfuscated patterns involving IEX (Invoke-Expression) and 'DownloadString' commonly used to download and execute scripts directly into memory, often following an AMSI bypass attempt.
This rule detects the execution of PowerShell with hidden window styles and encoded commands that is correlated with a concurrent update to Windows Registry Run or RunOnce keys. This combination is a common technique used by malware and adversaries to establish persistence on a host system.
This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.
Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects RemotePC RMM software (REMOTEPCSERVICE.EXE / RPCCMDHOST.EXE) spawning PowerShell with hidden window and IEX download cradle, consistent with Prinz Eugen ransomware group using RemotePC as a persistence and C2 channel.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.
Page 89 of 160