Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,427
11,813
5,871
5,145
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Identifies PowerShell commands that generate a unique victim ID by hashing the concatenated ComputerName and UserName, a technique used by the InstallFix malware.
This rule detects instances where 'Invoke-WebRequest' (or its aliases 'IEX', 'IWR') is executed by 'powershell.exe' directly from 'explorer.exe'. This pattern is often indicative of a user launching a malicious PowerShell command from the Run dialog, clipboard, or a shortcut, rather than within a legitimate script context. This specific detection is linked to the ClickFix campaign, which uses information stealers.
Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.
Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
Detects rapid clipboard monitoring and substitution behavior via PowerShell APIs.
This YARA rule detects the presence of various PowerShell commands and functions that are commonly used in malicious scripts. It looks for a combination of specific cmdlets like 'New-Object', 'Invoke-WebRequest', 'Invoke-Expression', 'Set-ExecutionPolicy Bypass', and 'Add-Type', as well as patterns for functions that might be used for obfuscation or specific malicious activities (e.g., 'vS35wIDY9U', 'wEAXbwCuxi'). The rule triggers if at least three of the defined strings or regular expressions are found, indicating potential PowerShell-based malicious activity.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup. This technique was observed in a campaign deploying obfuscated batch scripts disguised as PNG files into the Startup folder.
Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).
This rule detects PowerShell execution that includes specific command-line arguments consistent with decoding XOR-encoded payloads. It looks for 'powershell.exe' processes where the command line contains '-bxor' and references to files like 'Profile.ps1', '1.dat', or 'Com.dat', which are associated with the Dragon Weave campaign's decoding activities.
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects PowerShell launched with hidden or non-interactive options and encoded, compressed, or character-reassembled content. This behavior is often indicative of malicious activity, as adversaries use these techniques to evade detection and obscure their commands.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Page 99 of 160