Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Detects the use of common PowerShell cmdlets often associated with fileless malware execution, such as 'Invoke-Expression', 'IEX', or 'DownloadString', initiated by 'powershell.exe'. These patterns are frequently used to download and execute malicious payloads directly in memory, bypassing traditional disk-based scanning.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Detects the execution of a PowerShell script named 'nm.ps1', which has been associated with the Seedworm threat group for staging purposes. This rule specifically looks for 'nm.ps1' within process command lines.
Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects ClearFake PowerShell stager using 'iex' (Invoke-Expression) and 'irm' (Invoke-RestMethod) with '-UseBasicParsing'. This combination is often used by malware to download and execute scripts from the internet, bypassing more robust parsing mechanisms.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.
Detects the use of PowerShell with 'Invoke-WebRequest' to download trojanized installers (MicrosoftEdgeSetup.exe, ChromeSetup.exe, MSTeamsSetup.exe) from malicious domains like 'apple-online.shop' or 'trycloudflare.com', as observed in Interlock activity leveraging JunkFiction.
Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.
Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.
This rule detects PowerShell commands or script block executions involving the creation of desktop shortcuts associated with the VILE ransomware decryptor. The rule specifically looks for the usage of WScript.Shell, the -NoProfile flag, and references to 'vile_Decryptor' or 'vile_icon.ico' in the command line or script content.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
Page 93 of 160