Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects wscript.exe spawning PowerShell with encoded command from C:\Temp.
Detects users copy-pasting PowerShell commands from fake 'system error' prompts.
Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects PowerShell executing base64 encoded payloads or the string "I am not a robot" typically associated with FakeCaptcha malware found in the clipboard. This rule specifically looks for these indicators within the process command line of PowerShell or pwsh processes.
Detects the execution of Invoke-SMBRemoting for fileless lateral movement, specifically looking for PowerShell processes with 'Invoke-SMBRemoting' in their command line.
Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects disabling of PowerShell command history logging to impair forensics
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Detects PowerShell executing heavily obfuscated commands utilizing both Base64 conversion and DeflateStream decompression, a signature of the Codex loader.
Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.
Tracks the escalation of a Potentially Unwanted Program (PUP) installer executing wscript.exe, which then spawns powershell.exe, finally culminating in the execution of the AutoIt3 interpreter. This sequence is indicative of a common Remote Access Trojan (RAT) loader technique.
Correlates the PowerShell process allocating virtual memory with PAGE_EXECUTE_READWRITE permissions, setting up the memory space for process hollowing.
Page 97 of 160