Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
Detects obfuscated PowerShell execution using environment variables, specifically looking for patterns indicative of Invoke-Obfuscation's VAR+ launcher. This technique involves setting environment variables with parts of a command and then reconstructing and executing it, often to evade detection.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from direct IP addresses. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads, bypassing traditional web proxies or security controls that might monitor domain-based traffic.
This rule detects the execution of PowerShell commands via `cmd.exe` where the PowerShell script is passed through standard input (STDIN) and includes obfuscation techniques. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to pipe output to `powershell.exe`, and the PowerShell command itself contains either `${input}` or `noexit` along with `Invoke-Expression` and `DownloadString` patterns, indicative of obfuscated remote code execution.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
This rule detects PowerShell command lines that exhibit characteristics of obfuscation by looking for repeated special characters such as '+', '{', '^', and '`'. These patterns are commonly used by adversaries to evade detection by making the command less readable or to bypass signature-based defenses. The rule specifically targets PowerShell (powershell.exe) and PowerShell Core (pwsh.exe) processes.
Detects obfuscated use of stdin to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule specifically looks for patterns in PowerShell module logs (Event ID 4103) where 'cmd' is used with '/c' or '/r' to launch PowerShell, incorporating input from stdin (e.g., using ${input} or noexit).
Detects the use of Invoke-Obfuscation's VAR+ Launcher technique, which leverages obfuscated environment variables to execute PowerShell commands. This technique aims to evade detection by making the command-line arguments difficult to analyze.
This rule detects potential PowerShell obfuscation techniques where the '-join' operator is used within the '-Value' parameter of 'Set-Alias' or 'New-Alias' cmdlets. This method is often employed by adversaries to hide the true command or object being aliased, making it harder to analyze the script's intent. The rule specifically looks for the combination of '-Alias' and ' -Value (-join(' within PowerShell script block text.
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Detects obfuscated PowerShell execution via standard input (stdin) in scripts. This technique is often used by adversaries to evade detection by security tools that might inspect command-line arguments.
Detects the PowerShell command lines with special characters
Yara rule that detects Minodo backdoor.
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Yara rule that detects BlueLocker ransomware.
Yara rule that detects Khonsari ransomware.
Page 80 of 81