Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
10
6
Contributors
10
6
Categories
11
9
8
3
3
Platforms
15
Products / Services
6
4
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
The following analytic detects the execution of multiple offensive toolkits and commands through the process execution datamodel. This method captures commands given directly to powershell.exe, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
Detects the creation of known offensive PowerShell scripts used for exploitation, reconnaissance, credential access, persistence, and other malicious activities. The rule identifies specific filenames associated with popular PowerShell offensive security frameworks and tools.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
The analytic detects the execution of the Get-GPPPassword or Get-CachedGPPPassword PowerShell cmdlets, which are used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with these cmdlets. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
This analytic detects the execution of the `Get-ForestTrust` command, often associated with the PowerSploit framework, via PowerShell Script Block Logging (EventCode=4104). This activity is significant because `Get-ForestTrust` is used to enumerate trust relationships within an Active Directory forest. Adversaries commonly perform this discovery technique as a precursor to lateral movement or privilege escalation, aiming to map out the environment for further exploitation and access to sensitive resources. Detecting this command provides visibility into potential reconnaissance efforts by attackers.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
The analytic detects the execution of multiple offensive toolkits and commands through the process execution datamodel. This method captures commands given directly to powershell.exe, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
This analytic detects the execution of the `Get-ForestDomain` cmdlet, which is part of the PowerView toolkit. PowerView is commonly used for Windows domain enumeration, particularly for gathering detailed information about Active Directory forest and domain configurations. The detection relies on PowerShell Script Block Logging (EventCode=4104). Adversaries and Red Teams utilize this cmdlet to understand the domain structure, which can facilitate lateral movement or privilege escalation within an environment.
This analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). It captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
This rule detects highly relevant antivirus events in the Windows Application log by looking for specific keywords associated with known virus signatures, malware, and offensive security tools. It aims to identify instances where an antivirus product has detected or quarantined malicious software or activity.
Detects highly relevant antivirus alerts indicating the presence of hack tools or other attack tools. This rule emphasizes that even if the antivirus blocks the malware, the event requires investigation to understand how the tool initially compromised the system.
This rule detects HTTP requests containing user-agent strings commonly associated with known scanning and reconnaissance tools such as Wfuzz, WPScan, and Recon-ng. These tools are often used by attackers to gather information about web applications and infrastructure before launching an attack.
This rule detects specific code artifacts commonly found in offensive PowerShell payloads such as Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, and PowerSploit. These artifacts often remain unchanged due to poor operational security practices by attackers. The rule looks for specific strings like '$DoIt', 'harmj0y', 'mattifestation', '_RastaMouse', 'tifkin_', and '0xdeadbeef' within PowerShell script payloads.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.