Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
This rule detects when common Windows shell and scripting applications (such as bash.exe, cmd.exe, cscript.exe, powershell.exe, certutil.exe, mshta.exe, wmic.exe, etc.) write files to suspicious system folders. The suspicious folders include 'C:\PerfLogs\', 'C:\Users\Public\', and 'C:\Windows\Temp\'. This activity can indicate an adversary attempting to stage or execute malicious payloads in less scrutinized directories for persistence or defense evasion.
Detects the execution of SyncAppvPublishingServer.exe, which can be abused by adversaries to bypass PowerShell execution restrictions. This rule specifically looks for the string 'SyncAppvPublishingServer.exe' within the 'ContextInfo' field of PowerShell module logs, indicating its use in a PowerShell context.
This rule detects suspicious PowerShell activity involving the mounting of a disk image (like ISO or VHD) and then immediately invoking an item from that mounted image. This technique is often used by adversaries to bypass Mark-of-the-Web (MOTW) protections, as files extracted or run from mounted disk images may not inherit the MOTW flag, allowing malicious payloads to execute without security warnings.
Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.
This rule detects the execution of PowerShell scripts where the script path explicitly includes or references the "C:\Users\Public" directory. This directory is often used by adversaries to store and execute malicious scripts due to its default write permissions for all users, making it a common location for staging and executing payloads.
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
This rule detects specific command-line patterns associated with FIN7's reconnaissance and POWERTRASH execution, as reported by WithSecureLabs. It looks for PowerShell commands that include '-noni -nop -exe bypass -f \\' and 'ADMIN$' or '-ex bypass -noprof -nolog -nonint -f' and 'C:\Windows\Temp\'. These patterns indicate attempts to execute PowerShell scripts, potentially for remote access or privilege escalation, often targeting administrative shares or temporary directories.
This rule detects the use of specific Windows API (WinAPI) libraries within PowerShell scripts. Attackers often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell function calls. The rule specifically looks for the presence of 'Advapi32.dll', 'kernel32.dll', 'KernelBase.dll', 'ntdll.dll', 'secur32.dll', and 'user32.dll' within the PowerShell script block text. This can indicate attempts to perform low-level system operations or interact with the operating system in a way that might evade higher-level monitoring.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the execution of ADRecon.ps1, a PowerShell script used for Active Directory reconnaissance. The rule identifies specific function names and a default report filename commonly found within the ADRecon script. This tool has been reported to be actively used by the FIN7 threat group.
This rule detects the execution of the PowerShell cmdlet 'Remove-ADGroupMember' with parameters '-Identity' and '-Members'. This cmdlet is used to remove one or more members from an Active Directory group. In the context of this rule, it specifically targets the removal of an account from the 'Domain Admins' group, which could be an adversary's attempt to inhibit access to critical accounts or to clean up their tracks after gaining access.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
This rule detects suspicious PowerShell process creations that include base64 encoded commands. It looks for PowerShell or pwsh executables being launched with the '-e', '-en', or '-enc' command-line arguments, combined with specific base64 encoded strings commonly associated with malicious activity (e.g., ' JAB', ' SUVYI', ' SQBFAFgA', ' aQBlAHgA', ' aWV4I', ' IAA', ' IAB', ' UwB', ' cwB'). It also includes a standalone detection for '.exe -ENCOD ' and ' BA^J e-' (reversed). This pattern is often used by malware like Emotet to obfuscate their command-and-control instructions or payloads.
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
Detects potential process and execution activity related to the APT10 Cloud Hopper operation. Specifically, it looks for `cscript.exe` executing VBScripts with a `/shell` argument and `csvde` commands attempting to export data to a log file in `C:\windows\web\`.
Detects possible malicious execution of JavaScript for Automation (JXA) in-memory via the `osascript` utility on macOS. This rule specifically looks for command-line executions of `osascript` that include the `-e` flag (for executing a script string), the `eval` function, `NSData.dataWithContentsOfURL` (indicating potential remote content loading), and either explicitly specifies 'JavaScript' as the language or includes '.js' in the command line.
Page 183 of 191