Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,439
11,829
5,873
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of the built-in Windows script 'gatherNetworkInfo.vbs' via cscript.exe or wscript.exe. This script is designed to gather detailed network information about the target machine, which can be leveraged by adversaries for reconnaissance purposes.
Detects code execution where PowerShell (powershell.exe or pwsh.exe) is the parent process and its command line contains references to the Pester module, specifically when Pester is used to invoke other commands or scripts. This could indicate an adversary leveraging Pester for execution, potentially for defense evasion or to bypass security controls.
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command line, which could indicate a suspicious activity. This pattern is often observed in scripts attempting to execute commands via Windows Script Host (WSH) objects.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
Detects Wscript or Cscript executing a file with an uncommon (i.e., non-script) extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. This technique can be used by adversaries to bypass application control or obscure malicious script execution.
Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Detects the use of the WMI class "Win32_NTEventlogFile" within a PowerShell script to perform suspicious actions such as deleting, backing up, changing permissions, renaming, or taking ownership of event logs. This activity is often associated with defense evasion tactics by adversaries attempting to remove forensic evidence or impair system defenses.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.
This rule detects the execution of PowerShell scripts where the script content is provided via a redirected input stream. This technique is often used by adversaries to execute malicious PowerShell code without writing it to a file, which can help evade detection. The rule specifically looks for PowerShell or pwsh executables being run with a command line containing '- <', which signifies input stream redirection.
Detects the execution of PowerShell scripts from user-specific AppData directories (Local or Roaming). This behavior is often indicative of malware or adversary activity attempting to evade detection by running scripts from less common or user-writable locations, rather than standard system paths.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Detects suspicious shell commands used in various Equation Group scripts and tools
Detects suspicious shell commands used in various exploit codes (see references)
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Page 191 of 191