Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
96 detections
Filters
Last updated
All Time
Detection languages
37
26
21
4
2
Contributors
36
20
7
7
7
Categories
82
66
48
19
8
Platforms
95
1
1
1
Products / Services
51
18
13
12
7
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
This rule detects instances where wscript.exe or cscript.exe initiate a WMI activity that specifically queries for 'Win32_Process' and contains 'taskmgr.exe' within the query. This combination can indicate an attempt to enumerate or interact with the Task Manager process via scripting, which might be indicative of malicious activity such as process hiding or manipulation.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects execution of the EDRUnChoker remediation tool, useful for situational awareness. This rule specifically looks for the command line containing 'Install-EdrChokerWmiDefense.ps1', indicating the execution of a PowerShell script related to EDR evasion or manipulation.
Detects PowerShell referencing AMSI internals, reflection, or amsiInitFailed before executing a downloaded stage. This rule specifically looks for PowerShell processes executing commands that contain keywords related to AMSI bypass techniques, such as 'AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'amsiContext', 'GetField', combined with 'SetValue', 'Reflection', or 'NonPublic'. This indicates an attempt to modify AMSI's behavior in memory.
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
Detects PowerShell command lines attempting to disable AMSI (Antimalware Scan Interface) by leveraging 'AmsiUtils' and 'amsiContext'. This technique is often used by adversaries to evade security controls that rely on AMSI for script scanning.
This rule detects suspicious execution of wscript.exe or cscript.exe that involves VBScript or VBE files and contains keywords commonly associated with financial documents or urgent notifications in the command line. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating phishing attempts or malware execution.
Detects the execution of wscript.exe or cscript.exe (Windows Script Host) from a parent process that is not commonly associated with legitimate script execution. This can indicate malicious script execution, potentially bypassing security controls or being part of an initial access or execution chain. Exclusions are made for common legitimate parent processes like explorer.exe, cmd.exe, powershell.exe, svchost.exe, system.exe, and web browsers.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Detect Tiny Vbs
YARA
This YARA rule detects Visual Basic Script (VBS) files that contain common keywords often used in malicious VBScripts. Specifically, it looks for the presence of 'Dim' (for variable declaration), 'Wscript.Shell' (to interact with the operating system shell), 'End Function' (a VBScript construct), and 'CreateObject' (to create COM objects). The rule is designed to identify potentially malicious VBS files, possibly used for execution, persistence, or other adversarial activities.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
This YARA rule detects the presence of various PowerShell commands and functions that are commonly used in malicious scripts. It looks for a combination of specific cmdlets like 'New-Object', 'Invoke-WebRequest', 'Invoke-Expression', 'Set-ExecutionPolicy Bypass', and 'Add-Type', as well as patterns for functions that might be used for obfuscation or specific malicious activities (e.g., 'vS35wIDY9U', 'wEAXbwCuxi'). The rule triggers if at least three of the defined strings or regular expressions are found, indicating potential PowerShell-based malicious activity.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Page 1 of 5