Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
Detects the loader interrogating the process list for a specific cluster of sandbox/analysis tools before proceeding with the infection. This rule specifically looks for PowerShell executing and its command line containing at least two of the listed sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview).
Detects the creation or modification of a Registry Run key to establish persistence using PowerShell with specific obfuscation techniques. The rule looks for PowerShell commands that include '-NoProfile', '-ExecutionPolicy Bypass', '-WindowStyle Hidden', and '-File', and also references a temporary directory ('AppData\\Local\\Temp'). This combination is often used by adversaries to execute malicious scripts discreetly upon user logon.
Detects the creation or modification of a Registry Run key that executes PowerShell with specific parameters indicating a hidden window, no profile, bypass execution policy, and referencing a script in the AppData\Local\Temp directory. This is a common technique used by adversaries for persistence and to evade detection.
Detects PowerShell execution attempting to interact with AppX packages using 'DiscCoerceProbe'. This activity is often associated with privilege escalation or system manipulation techniques.
Detects PowerShell execution with '-ExecutionPolicy Bypass -File' arguments, combined with specific suspicious file paths or command-line strings often associated with privilege escalation or malicious activity. It also looks for suspicious AppX package management commands.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
This rule detects initial access attempts involving double-extension shortcuts (.lnk) that lead to the execution of VBScript (VBS) files, which subsequently launch PowerShell scripts for decryption. The detection logic specifically looks for a .lnk file executing a command line containing '.vbs', followed within 5 minutes by a PowerShell process executing a command line containing 'Profile.ps1' or '-bxor'. This chain of events is indicative of malicious activity often used in phishing campaigns to bypass security controls and execute obfuscated payloads.
Detects PowerShell downloading a packed loader DLL and writing it directly to the C:\Users\Public directory. This rule specifically looks for file creation events where the file path is within 'C:\Users\Public', the file name ends with '.dll', and the initiating process is 'powershell.exe'.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects PowerShell or .NET code modifying ServicePointManager or certificate validation callbacks so later downloads accept untrusted certificates. This behavior is often associated with malware like InstallFix to bypass security measures during C2 communication or payload delivery.
Page 95 of 160