Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by PowerShell. Adversaries may abuse BITS jobs for persistence, execution, or data transfer, and using PowerShell to create these jobs is a common method.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). This rule specifically looks for `wmic.exe` loading scripting libraries like `jscript.dll` or `vbscript.dll`.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.
Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
Detects the execution of SyncAppvPublishingServer.exe, which is often used by adversaries to bypass PowerShell execution restrictions. This technique is part of the LOLBAS (Living Off The Land Binaries and Scripts) project, where legitimate system binaries are abused for malicious purposes, specifically to execute PowerShell commands in a way that might evade traditional security controls.
This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.
Detects PowerShell command-line obfuscation techniques, specifically those associated with Invoke-Obfuscation, by looking for patterns like backticks, string concatenation, and format string abuse in process command lines. It also includes a specific pattern for obfuscated environment variable access.
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.
Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.
Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.
Detects obfuscated use of environment variables to execute PowerShell commands. This technique is often used by adversaries to evade detection by security products. The rule specifically looks for the creation of a service with a command-line containing 'cmd', 'set', '-f', and either '/c' or '/r', which are indicative of a PowerShell command being constructed and executed via environment variables.
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
This rule detects PowerShell commands that use `Get-ChildItem` with `-Recurse` and `-Include` parameters to search for common document and archive file extensions. This behavior is indicative of an adversary attempting to automatically collect sensitive data from a system or network.
This rule detects the use of '.CopyFromScreen' within PowerShell script block text. This API call is commonly used by adversaries to capture screenshots of the desktop, which is a technique for gathering information during an operation. The detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Page 184 of 191