Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
96 detections
Filters
Last updated
All Time
Detection languages
37
26
21
4
2
Contributors
36
20
7
7
7
Categories
82
66
48
19
8
Platforms
95
1
1
1
Products / Services
51
18
13
12
7
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
This rule detects PowerShell commands indicative of reflective code loading, specifically looking for the use of 'Assembly' and 'Load' or 'GetType' and 'Invoke' within PowerShell command arguments. It filters out common noise associated with legitimate PowerShell operations like PSGet, Cursor, and internal Microsoft PowerShell modules to reduce false positives.
Detects the classic Matt Graeber AMSI bypass technique using reflection to set amsiInitFailed to True. This one-liner disables AMSI scanning for the entire PowerShell session.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
This rule detects PowerShell scripts attempting to identify a virtualization or sandbox environment. It specifically looks for the use of WMI objects like 'MSAcpi_ThermalZoneTemperature' and 'Win32_ComputerSystem' in PowerShell script block text, which are commonly queried by malware to determine if it's running in a virtualized environment.
This analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as Base64 encoding is often used by attackers to obfuscate malicious payloads, making it harder to detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system.
The analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
The analytic detects the creation, modification, or enabling of scheduled tasks that execute commands using native Windows shells (PowerShell, Cmd, Wscript, Cscript) or from public folders (Users, Temp, ProgramData). This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the `Compress-Archive` command targeting the `Temp` directory. This activity is significant as it may indicate an adversary's attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.
This rule detects potential obfuscated or stealthy PowerShell execution by identifying PowerShell commands that do not use the default 'powershell' or 'pwsh' executable names but still contain common PowerShell command-line arguments such as '-NoProfile', '-ExecutionPolicy', or 'Invoke-Expression'. It correlates these executions with user logon sessions to aid in attribution and threat hunting.
Detects reflective loading of .NET assemblies from memory within PowerShell. This technique is often used to execute malicious code while bypassing file-based detections and some AMSI features, as the assembly is loaded directly from a byte array rather than from a file on disk.
This rule detects PowerShell script blocks that attempt to bypass AMSI (Antimalware Scan Interface) by patching or manipulating memory related to AMSI. It specifically looks for the presence of keywords like 'VirtualProtect', 'GetProcAddress', 'InteropServices', 'AmsiScanBuffer', and references to 'amsi.dll' or 'clr.dll' within PowerShell operational logs (EventID 4104). This combination of keywords indicates an attempt to programmatically interfere with AMSI's ability to scan script content.
Detects PowerShell obfuscation techniques in process command lines, including encoded commands, IEX with string manipulation, and long command lines with string functions, indicating potential malicious activity. The rule specifically looks for the use of '-encodedcommand' or its short forms with long command lines, 'iex' or 'invoke-expression' combined with string manipulation (like '+', '-join', '[char]', 'frombase64string') or very long command lines, and unusually long command lines that also contain string manipulation functions ('-join', 'replace', 'split').
Detects PowerShell commands that use Get-WmiObject to query Win32_Process, specifically looking for process names. This can be indicative of discovery or reconnaissance activities using WMI.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
Page 2 of 5