Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
3
3
2
2
2
Platforms
5
Products / Services
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Find all machines running a given Powersehll cmdlet.
This covers all Powershell commands executed in the Powershell engine by any process.
This covers all Powershell commands executed in the Powershell engine by any process.
ZLoader was delivered in a campaign in summer 2021 via malvertising. This campaign was tweeted about by @MsftSecIntel on twitter.
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
Detects the usage of the ".Net.Sockets.TCPClient" class within PowerShell, which is commonly abused to establish remote connections and reverse shells. This technique is notably used by tools like Nishang's "Invoke-PowerShellTcpOneLine" and other malicious scripts to create outbound network connections for command and control or data exfiltration.
Detects PowerShell command-line obfuscation techniques, specifically those associated with Invoke-Obfuscation, by looking for patterns like backticks, string concatenation, and format string abuse in process command lines. It also includes a specific pattern for obfuscated environment variable access.