Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.
Detects obfuscated use of environment variables to execute PowerShell commands. This technique is often used by adversaries to evade detection by security products. The rule specifically looks for the creation of a service with a command-line containing 'cmd', 'set', '-f', and either '/c' or '/r', which are indicative of a PowerShell command being constructed and executed via environment variables.
Detects the use of Invoke-Obfuscation's VAR++ LAUNCHER technique, which obfuscates PowerShell commands using variable manipulation and string formatting. This technique is identified by specific patterns in the ServiceFileName field of Windows Security Event ID 4697, indicating a service creation with obfuscated command-line arguments.
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Detects obfuscated PowerShell commands used in service creation events, specifically looking for patterns indicative of Invoke-Obfuscation's VAR++ LAUNCHER technique. The rule identifies service creations where the ImagePath contains specific keywords like '&&set', 'cmd', '/c', '-f', and format specifiers like '{0}', '{1}', etc., which are characteristic of highly obfuscated PowerShell commands often used for defense evasion.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
Detects specific filenames associated with Winnti dropper activity, as detailed in the RedMimicry Winnti playbook. The rule looks for the creation or modification of 'gthread-3.6.dll', 'sigcmm-2.4.dll', or 'Windows\Temp\tmp.bat', which are known indicators of compromise for Winnti malware.
Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.
This rule detects the creation of a new Windows service (EventID 4697) where the service's file name contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS OBFUSCATION technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either 'system.io.compression.deflatestream' or 'system.io.streamreader'. This combination suggests an attempt to decompress and execute obfuscated PowerShell code.
Detects obfuscated PowerShell execution initiated via rundll32.exe, specifically looking for the combination of 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell' within the ServiceFileName field of Windows Security Event ID 4697 (Service Creation). This technique is often used for defense evasion and to execute malicious PowerShell scripts.
Detects obfuscated PowerShell execution initiated via rundll32.exe. This rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName contains specific keywords indicative of rundll32.exe being used to execute obfuscated commands, potentially involving PowerShell.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Detects the usage of the 'base64' utility with the decode flag ('-d' or '--decode') on Linux systems. This activity can indicate an adversary attempting to deobfuscate or decode base64-encoded text, which is a common technique for hiding malicious payloads or commands.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for distinct string manipulation and variable concatenation techniques used by the framework within the ServiceFileName field of Windows Security Event ID 4697.
This rule detects the creation of a new Windows service where the ImagePath contains 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell'. This specific combination is indicative of an attempt to execute obfuscated PowerShell code via rundll32.exe, a common technique for defense evasion and execution.
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" within process command lines. This technique is often used by malware to dynamically load assemblies, evading static analysis.
Page 78 of 81