Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where PowerShell or cmd.exe drops an executable file (or extensionless file) into the C:\ProgramData directory, followed by the execution of that same file within a 2-minute window. This behavior is associated with the UAC-0226 campaign (GIFTEDCROOK loader chain) for staging malicious payloads.
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
This rule detects a multi-stage execution chain indicative of malicious LNK files placed in startup folders. It tracks the sequence starting with explorer.exe spawning cmd.exe (with /min switch), followed by a child powershell.exe utilizing common evasion flags, and concluding with a grandchild powershell.exe executing suspicious commands such as encoded commands, IEX, or referencing the ProgramData directory, all within a 10-minute window.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) following the reconnaissance of security software or AMSI providers. It correlates WMI or registry-based discovery activities concerning security products or AMSI configurations with subsequent PowerShell-based AMSI bypass indicators (such as specific strings or method names indicative of memory patching) occurring on the same host within a 10-minute window.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
This rule detects potentially malicious PowerShell behavior by correlating two events within a 5-minute window: first, a PowerShell process reading files from the C:\ProgramData directory, and second, the same process invoking sensitive memory manipulation APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx, GetDelegateForFunctionPointer). This pattern is commonly associated with fileless malware loaders or staging scripts that read encrypted payloads from disk and execute them in memory.
This rule detects common PowerShell command-line arguments and patterns used by attackers to bypass or disable Antimalware Scan Interface (AMSI) in memory. Attackers often attempt to modify non-public, static members of the AmsiUtils class to force AMSI initialization failure, allowing for the execution of malicious scripts without detection.
Detects a sequence where a command shell (cmd.exe) is launched with minimized window flags to run PowerShell, followed by a PowerShell process executing code using common file-less loading techniques, specifically using Invoke-Expression (iex) on content retrieved via Get-Content from within the ProgramData directory.
This rule detects PowerShell execution attempts that include strings associated with Anti-Malware Scan Interface (AMSI) bypass techniques. Specifically, it searches for command-line arguments that attempt to manipulate memory (VirtualProtect, Marshal.WriteByte, RtlMoveMemory) or interact with AMSI/PowerShell internals (AmsiScanBuffer, amsi.dll) commonly used to disable AMSI scanning within a running process.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
This rule detects potential malicious activity where a PowerShell process first attempts to bypass the Antimalware Scan Interface (AMSI) and subsequently executes code characteristic of a reverse shell or network-based command execution within a 10-minute window. This sequence is a common pattern for fileless malware or remote access trojans (RATs) attempting to evade detection and maintain persistence.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects attempts to tamper with security monitoring mechanisms including AMSI, ETW, and PowerShell Script Block Logging by monitoring process command line arguments for termination or configuration modifications and tracking registry key modifications related to these security features.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects instances where the Gemini CLI (gemini-cli) is used to spawn system shell interpreters (e.g., cmd.exe, bash, powershell) within CI/CD runner environments. This pattern is associated with potential abuse of the Gemini CLI workspace trust bypass or 'yolo' mode, which can lead to unauthorized code execution.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Page 117 of 213