Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
96 detections
Filters
Last updated
All Time
Detection languages
37
26
21
4
2
Contributors
36
20
7
7
7
Categories
82
66
48
19
8
Platforms
95
1
1
1
Products / Services
51
18
13
12
7
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.
Detects PowerShell scripts that enumerate installed hotfixes by querying 'Win32_QuickFixEngineering' and looking for 'HotFixID'. This activity is often performed by attackers during the discovery phase to gather system information.
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects the execution of PowerShell commands that utilize base64 encoded 'IEX' (Invoke-Expression) cmdlets. Adversaries often encode malicious PowerShell scripts in base64 to evade detection and obfuscate their intentions. The rule specifically looks for patterns indicative of base64 encoded 'IEX' calls, including variations with 'New-Object' and different casing, as well as UTF-16 LE encoded versions of common 'IEX' patterns.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects obfuscated PowerShell execution using environment variables, specifically looking for patterns indicative of Invoke-Obfuscation's VAR+ launcher. This technique involves setting environment variables with parts of a command and then reconstructing and executing it, often to evade detection.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Detects the execution of PowerShell scripts from user-specific AppData directories (Local or Roaming). This behavior is often indicative of malware or adversary activity attempting to evade detection by running scripts from less common or user-writable locations, rather than standard system paths.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Page 5 of 5