Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.
Detects obfuscated PowerShell execution leveraging `clip.exe` to retrieve commands from the clipboard. This technique is often used for defense evasion to hide malicious scripts.
Detects the use of `cmd.exe` to launch PowerShell commands that leverage `clip.exe` and the Windows clipboard for obfuscated execution. This technique is often used to evade detection by breaking up malicious payloads or commands.
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.
Detects PowerShell scripts that utilize compression and decompression techniques, specifically looking for 'new-object', 'text.encoding]::ascii', 'system.io.compression.deflatestream', 'system.io.streamreader', and 'readtoend' in the payload. This pattern is indicative of obfuscated PowerShell often used by tools like Invoke-Obfuscation to hide malicious code.
Detects obfuscated PowerShell execution leveraging MSHTA. This technique is often used for defense evasion by adversaries to execute malicious scripts without directly invoking PowerShell. The rule specifically looks for a combination of keywords indicative of this method, including 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' within the PowerShell module payload.
Detects obfuscated PowerShell scripts that utilize 'clip.exe' to interact with the clipboard, potentially for defense evasion or data manipulation. The rule specifically looks for the pattern 'echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?)' within PowerShell script block text, indicating an attempt to pipe output to clip.exe and then interact with the clipboard or invoke further commands.
This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.
Detects obfuscated PowerShell execution leveraging MSHTA. The rule specifically looks for command-line arguments that indicate the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)', which are common patterns in MSHTA-based PowerShell obfuscation.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.
Detects obfuscated PowerShell code being executed via standard input (stdin) within PowerShell module logs. This technique is often used by adversaries to evade detection by security products that monitor for suspicious commands or scripts.
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
Detects highly obfuscated PowerShell commands using the VAR++ LAUNCHER technique, often associated with Invoke-Obfuscation. This method involves using `&&set` and specific character patterns like `(\{\d\}){2,}\"` combined with `-f` and `cmd /c` to evade detection.
Page 79 of 81