Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Run from a Zip File
Sigma
Payloads may be compressed, archived, or encrypted in order to avoid detection
Page 73 of 81