Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
96 detections
Filters
Last updated
All Time
Detection languages
37
26
21
4
2
Contributors
36
20
7
7
7
Categories
82
66
48
19
8
Platforms
95
1
1
1
Products / Services
51
18
13
12
7
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
The analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for root domain linked policies. This activity is identified by leveraging PowerShell Script Block Logging (EventCode=4104) and looking for specific keywords like `[adsisearcher]`, `SearchRooT`, and `gplink`. This behavior is significant as it may indicate an attempt by adversaries or Red Teams to gain situational awareness and perform Active Directory Discovery, potentially aiding in further exploitation or lateral movement within the network.
This analytic detects attempts to modify or add a Component Object Model (COM) entry to the InProcServer32 path within the registry using PowerShell. It leverages PowerShell ScriptBlock Logging (EventCode 4104) to identify suspicious script blocks that target the InProcServer32 registry path. This activity is significant because modifying COM objects can be used for persistence or privilege escalation by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary code or maintain persistent access to the compromised system, posing a severe security risk.
Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious PowerShell execution. This includes attempts to execute base64 encoded commands, use of `IEX` (Invoke-Expression) with hidden windows and `New-Object`, execution of encoded commands, and use of `WebClient` to download and execute content.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
Detects suspicious execution of AgentExecutor.exe, a Microsoft Intune component, when it is used to launch PowerShell scripts with potentially bypassed execution policies or to execute a 'powershell.exe' binary from a specified path. This behavior can be indicative of a Living Off The Land Binary (LOLBIN) abuse.
This rule detects the installation of a root certificate on a Windows system via PowerShell. It specifically looks for PowerShell script block text containing commands like 'Move-Item' or 'Import-Certificate' targeting the 'Cert:\LocalMachine\Root' path. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting.
This rule detects the use of PowerShell cmdlets to exfiltrate email addresses. Specifically, it looks for PowerShell processes executing commands that include 'Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', and '-hidetableheaders'. This combination of cmdlets is indicative of an attempt to enumerate and extract email addresses from a system, likely for exfiltration purposes.
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
This rule detects command-line executions that include specific function calls, 'LoadAssemblyFromPath' or 'LoadAssemblyFromNS', which are associated with the 'CL_LoadAssembly.ps1' script. This script can be leveraged to load .NET assemblies, potentially bypassing AppLocker controls and executing arbitrary code. The detection focuses on instances where these function calls are made directly via command-line arguments, such as through PowerShell's '-Command' or '-ScriptBlock' flags.
Detects the usage of `[Reflection.Assembly]::load` functions within PowerShell script block logs. This method allows for dynamically loading assemblies into memory, which can be used by adversaries to execute malicious code without writing it to disk, thus evading traditional file-based detections.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
Detects the use of the Microsoft signed script "CL_mutexverifiers.ps1" to proxy the execution of additional PowerShell script commands. This technique can be used by adversaries for defense evasion by leveraging a trusted, signed script to execute malicious code.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
Page 4 of 5