Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects attempts to abuse Windows Defender Application Control (WDAC) policies, specifically looking for the execution of 'RefreshPolicy.exe' or PowerShell commands containing 'Merge-CIPolicy'. This activity is associated with the Interlock threat group, which is known to drop custom WDAC policies to allow their tooling and block EDR components.
Hunts for the full SEO poisoning / Phishing chain: User clicks LNK -> Spawns CMD -> Invokes PowerShell.
Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.
Detects the dropping of reverse proxy binaries (like Ngrok or Cloudflare tunnel daemons) by PowerShell, which could be used to expose internal Terminal Services to the internet. This activity is often associated with phishing campaigns targeting Terminal Servers.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using a combination of arguments and commands commonly associated with script obfuscation or file-less execution patterns. This includes the use of ReadAllText for file reading, environment variable manipulation, and common execution aliases (iex/Invoke-Expression) combined with the -nop (NoProfile) flag.
Vidar In Memory Assembly
YARA-L
Identifies PowerShell dynamically converting the extracted Base64 string into bytes and loading it directly into memory.
Identifies PowerShell dynamically converting a Base64 string into bytes and loading it directly into memory, a technique often used by malware like Vidar for reflective code loading.
Detects execution of PowerShell commands using WScript.Shell to create shortcuts, specifically looking for indicators related to 'vile_Decryptor.lnk' or 'vile_icon.ico'. This pattern is frequently observed in malware deployment or dropper activities aiming to establish persistence or facilitate user-driven execution.
Detects a suspicious PowerShell execution pattern observed in Pay2Key ransomware, where PowerShell attempts to read and execute the contents of a setup.cmd file (referred to by environment variable) using [io.file]::ReadAllText and iex.
Detects the Pay2Key ransomware's use of a polyglot setup.cmd script that executes embedded PowerShell code in-memory. The detection focuses on PowerShell being launched with the '-nop' flag and a specific pattern using [io.file]::ReadAllText($env:0) to read and execute the script's own content, a technique characteristic of Pay2Key's fileless execution.
Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects a malicious pattern often associated with Pay2Key where a Batch script executes PowerShell via the Sysnative folder to bypass redirection. The command uses -nop and iex to execute code directly from the script file content (using $env:0) in-memory, indicative of fileless execution techniques.
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects developers pasting malicious PowerShell one-liners from fake install pages.
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Page 92 of 160