Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of 'tango13.ps1', a PowerShell payload associated with the Iranian APT group MuddyWater (also known as Seedworm or APT33), which has been observed being dropped via Microsoft Teams.
This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.
Parses PowerShell command lines to identify scripts extracting PGP private key blocks from arbitrary files to decode nested stagers.
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
Detects the execution sequence associated with TonRAT malware, including the launching of PowerShell from explorer.exe via malicious LNK files (often disguised as photo or image files) and the subsequent execution of a node.exe process from user-writable directories such as AppData or Temp.
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
Detects the use of the PowerShell 'Compress-Archive' cmdlet to archive files within user-writable temporary or application directories. This behavior is often indicative of an attacker staging data prior to exfiltration.
This rule detects PowerShell or CMD processes executing host profiling and system discovery commands (e.g., whoami, hostname, systeminfo) that are initiated by processes linked to the 'lightlife.ps1' script or associated Lightlife RAT activity.
Detects instances of PowerShell being launched by common scripting host binaries (mshta.exe, wscript.exe, cscript.exe) with command-line arguments indicative of malicious activity, such as encoded commands, hidden windows, and remote code download patterns (e.g., iex, Invoke-RestMethod). The rule further checks for indicators related to the Lightlife C2 infrastructure.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects the creation of new local user accounts by monitoring for the 'net user /add' command or the 'New-LocalUser' PowerShell cmdlet. This activity is commonly used by malware, such as Amadey and StealC, to establish persistence on a compromised system.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.
Detects a suspicious pattern consistent with the REF8372 OXLOADER malware delivery, where a batch file (BAT) is executed from the Downloads or Temp directories using cmd.exe, which then spawns PowerShell to download external content from link.storjshare.io.
Detects the TuglaInsaatci steganographic loader establishing persistence via a Windows Run registry key. The rule identifies suspicious PowerShell commands (execution policy bypass, hidden window, hidden file path) pointing to a script located within the AppData\Local\Temp directory, a technique associated with the FortiBleed campaign to deliver the Remcos RAT.
Detects a registry modification to the HKCU Run key that executes a PowerShell script located in the %TEMP% directory. This behavior is associated with the TuglaInsaatci steganographic .NET loader campaign, often used to drop commodity malware such as Remcos RAT.
Detects execution of PowerShell commands originating from a batch (.bat/.cmd) script that utilize .NET WebClient methods (DownloadString/DownloadFile) combined with process execution cmdlets (Start-Process/Invoke-Expression/IEX). This pattern is associated with the delivery and execution of the OXLOADER malware via BATPackageBuilderSetup.bat.
Identifies the threat actor executing PowerShell commands to add entire root directories (C:\) to Defender's exclusion list before dropping the ransomware payload.
Hunts for PowerShell scripts natively importing cryptographic classes (AesManaged, CryptoStream) to decrypt secondary payloads directly in memory.
Page 94 of 160