Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This analytic detects attempts to modify or add a Component Object Model (COM) entry to the InProcServer32 path within the registry using PowerShell. It leverages PowerShell ScriptBlock Logging (EventCode 4104) to identify suspicious script blocks that target the InProcServer32 registry path. This activity is significant because modifying COM objects can be used for persistence or privilege escalation by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary code or maintain persistent access to the compromised system, posing a severe security risk.
This analytic identifies the use of the `get-localgroup` command executed via PowerShell or cmd.exe to enumerate local groups on an endpoint. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is significant as it may indicate an attacker attempting to gather information about local group memberships, which can be a precursor to privilege escalation. If confirmed malicious, this activity could allow an attacker to identify and target privileged accounts, potentially leading to unauthorized access and control over the system.
The analytic detects the execution of `powershell.exe` with command-line arguments that query for domain groups using `Get-DomainGroup`. This activity is often associated with PowerView, a tool used by adversaries for domain enumeration and situational awareness. Detecting this can help identify attackers gaining insights into domain group structures, which could aid in further exploitation and privilege escalation.
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique is used by threat actors and ransomware strains to evade defenses by removing forensic evidence.
Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.
Detects when a PowerShell script uses the 'New-NetFirewallRule' cmdlet to create a new firewall rule with an 'Allow' action. This activity can indicate an adversary attempting to bypass host-based firewalls to enable command and control, lateral movement, or data exfiltration.
Detects the execution of obfuscated PowerShell one-liners designed to download and execute PowerShell modules in memory. This rule specifically looks for PowerShell command lines containing a URL (e.g., 'http://127.0.0.1'), the 'IRM' (Invoke-RestMethod) alias within a loop ('%{(IRM $_)}'), and the 'Invoke' keyword, which are indicative of in-memory module execution.
Detects the execution of known attacker tools, including but not limited to those in the IronSharpPack toolset. These tools are commonly used for offensive security operations and may indicate malicious activity if observed in unauthorized environments.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool for administering Azure AD and Office 365, which can be abused by threat actors to attack these services. The rule specifically looks for PowerShell processes executing commands containing the unique string "-AADInt" followed by various cmdlet actions like Add, ConvertTo, Disable, Enable, Export, Find, Get, Grant, Initialize, Install, Invoke, Join, New, Open, Read, Register, Remove, Reset, Resolve, Restore, Save, Search, Send, Set, Start, Unprotect, or Update.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.
Detects executions of WScript.exe or CScript.exe that are running scripts with common extensions (e.g., .js, .vbs) from suspicious temporary or public user directories. This behavior is often associated with dropper scripts used in initial access or malware delivery.
Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Detects the execution of Python code that imports the 'pty' and 'socket' modules and uses 'spawn' and '.connect' functions, which is a common pattern for establishing a reverse shell.
Detects the use of 'tail' to extract bytes at an offset from an image file (e.g., JPEG, PNG) and then pipe the output to 'base64 --decode' to create a new file with the decoded content. This technique is often used by adversaries to deobfuscate or extract hidden payloads from seemingly innocuous image files, typically executed as a bash one-liner.
Page 179 of 191