Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
184 detections
Filters
Last updated
All Time
Detection languages
71
70
10
8
8
Contributors
47
32
24
15
10
Categories
137
102
96
51
10
Platforms
163
12
11
9
1
Products / Services
49
43
31
17
13
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
3
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
This rule detects the execution of PowerShell with specific command-line obfuscation patterns known to be used by the CrackMapExec (CME) penetration testing framework. The rule looks for PowerShell executable names and specific string patterns within the command line that CME uses for obfuscation, such as 'join*split', '( $ShellId[1]+$ShellId[13]+''x'')', '( $PSHome[*]+$PSHOME[*]+', '( $env:Public[13]+$env:Public[5]+''x'')', and '( $env:ComSpec[4,*,25]-Join'''')'. These patterns are designed to evade simple string-based detections.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
Detects PowerShell scripts that utilize compression and decompression techniques, specifically looking for 'new-object', 'text.encoding]::ascii', 'system.io.compression.deflatestream', 'system.io.streamreader', and 'readtoend' in the payload. This pattern is indicative of obfuscated PowerShell often used by tools like Invoke-Obfuscation to hide malicious code.
Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
This rule detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. It specifically looks for command-line arguments that use variable manipulation (e.g., $PSHome, $ShellId, $env:Public, $env:ComSpec) and string concatenation to construct and execute PowerShell commands, which is a common technique for defense evasion.
Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.
Detects highly obfuscated PowerShell commands using the VAR++ LAUNCHER technique, often associated with Invoke-Obfuscation. This method involves using `&&set` and specific character patterns like `(\{\d\}){2,}\"` combined with `-f` and `cmd /c` to evade detection.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.
Detects the use of Invoke-Obfuscation's VAR+ Launcher technique, which leverages obfuscated environment variables to execute PowerShell commands. This technique aims to evade detection by making the command-line arguments difficult to analyze.
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Page 9 of 9