Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell executing a one-liner Invoke-WebRequest to pull the TiFlux installer directly from an attacker-hosted repository or the vendor.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load to execute the compiled ClassLibrary stage filelessly.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
This rule detects PowerShell executing a payload deceptively named as a JPEG image file, specifically 'sysupdate.jpeg', followed by subsequent outbound network activity. This behavior is indicative of the SilentCanvas campaign.
This rule detects potential persistence mechanism installation by monitoring the creation of registry values in 'Run' or 'RunOnce' keys, followed by the execution of 'powershell.exe' or 'wscript.exe' on the same host within a 5-minute window.
Detects a hidden PowerShell stage creating a process through Start-Process, WMI, reflection, or .NET process APIs. This rule specifically looks for executable files spawned by PowerShell processes where the PowerShell command line contains keywords indicative of process creation methods like 'Start-Process', 'ProcessStartInfo', 'Win32_Process', 'CreateProcess', or 'Invoke-Expression'.
Detects instances where 'wt.exe' (Windows Terminal) is used to execute PowerShell or Command Prompt with suspicious command-line arguments often associated with initial execution vectors for ClickFix lures. Specifically looks for hidden window styles, bypass execution policy, or no profile arguments.
Detects PowerShell executing the CreateInstallServiceWork function with a custom FulfillmentPluginId, which is indicative of the UnCanny coercion technique.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Detects a .NET loader interrogating the process list for a specific cluster of sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview) using PowerShell before proceeding with its malicious activity. The rule triggers when PowerShell command line arguments contain at least two of the specified tools.
Identifies the core ClickFix vector: explorer.exe (via the Windows Run prompt) executing pasted PowerShell commands containing IEX and Get-Clipboard to execute the first stage.
Detects PowerShell using the Add-Type cmdlet to dynamically compile C# code referencing keylogging (SetWindowsHookEx) or screen capture (CopyFromScreen) APIs. This behavior is indicative of PS1Bot in-memory module execution.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
This rule detects the use of PowerShell to create or modify Quality of Service (QoS) policies, specifically looking for the 'New-NetQosPolicy' cmdlet combined with parameters related to bandwidth throttling ('ThrottleRateActionBitsPerSecond') or application targeting ('AppPathNameMatchCondition'). This activity can be indicative of an attacker attempting to disrupt EDR agent connectivity by severely limiting network bandwidth, a technique associated with 'EDRChoker'.
Detects ClickFix payloads executing PowerShell with invoke-expression (iex) and invoke-restmethod (irm) to fetch remote payloads into memory without touching disk, as seen in DeepLoad delivery.
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Detects Explorer.exe spawning PowerShell to fetch a polymorphic server-side payload where the URL contains randomized alphanumeric parameters preventing static caching.
Identifies the execution of IEX (New-Object Net.WebClient).DownloadString directly from a run prompt, avoiding disk writes entirely. This rule specifically looks for PowerShell command-line activity where 'IEX' is used in conjunction with 'New-Object Net.WebClient).DownloadString', indicating an attempt to download and execute content directly in memory.
Correlates the ClickFix execution directly to the creation of the NetSupport RAT files (client32.exe) in public directories, specifically when PowerShell is used to access the clipboard.
Detects Windows Explorer executing an LNK file that directly spawns PowerShell to download the next-stage tax lure payload. This pattern is indicative of a phishing attack attempting to deliver malicious content.
Page 98 of 160