Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Detects the execution of the Nishang 'Invoke-PowerShellTcp' reverse shell payload via PowerShell. This rule monitors for common obfuscated patterns involving IEX (Invoke-Expression) and 'DownloadString' commonly used to download and execute scripts directly into memory, often following an AMSI bypass attempt.
This rule detects the execution of PowerShell with hidden window styles and encoded commands that is correlated with a concurrent update to Windows Registry Run or RunOnce keys. This combination is a common technique used by malware and adversaries to establish persistence on a host system.
This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.
Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
Detects the execution of common command-line utilities (cmd, powershell, wscript, cscript, mshta, certutil) directly spawned by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This is a common indicator of macro-based attacks or other exploit delivery chains where Office documents are used to execute malicious payloads.
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects instances where common browser processes or Windows Explorer initiate suspicious child processes like cmd.exe, powershell.exe, or mshta.exe. The rule uses a scoring mechanism based on the presence of encoded command indicators, web-related payloads, or specific HTA script arguments to identify potentially malicious activity such as drive-by downloads or living-off-the-land execution.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
Detects RemotePC RMM software (REMOTEPCSERVICE.EXE / RPCCMDHOST.EXE) spawning PowerShell with hidden window and IEX download cradle, consistent with Prinz Eugen ransomware group using RemotePC as a persistence and C2 channel.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
Page 118 of 213