Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of the PowerShell 'Compress-Archive' cmdlet to archive files within user-writable temporary or application directories. This behavior is often indicative of an attacker staging data prior to exfiltration.
Detects instances of PowerShell being launched by common scripting host binaries (mshta.exe, wscript.exe, cscript.exe) with command-line arguments indicative of malicious activity, such as encoded commands, hidden windows, and remote code download patterns (e.g., iex, Invoke-RestMethod). The rule further checks for indicators related to the Lightlife C2 infrastructure.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.
Detects a suspicious pattern consistent with the REF8372 OXLOADER malware delivery, where a batch file (BAT) is executed from the Downloads or Temp directories using cmd.exe, which then spawns PowerShell to download external content from link.storjshare.io.
Detects the TuglaInsaatci steganographic loader establishing persistence via a Windows Run registry key. The rule identifies suspicious PowerShell commands (execution policy bypass, hidden window, hidden file path) pointing to a script located within the AppData\Local\Temp directory, a technique associated with the FortiBleed campaign to deliver the Remcos RAT.
Detects a registry modification to the HKCU Run key that executes a PowerShell script located in the %TEMP% directory. This behavior is associated with the TuglaInsaatci steganographic .NET loader campaign, often used to drop commodity malware such as Remcos RAT.
Detects execution of PowerShell commands originating from a batch (.bat/.cmd) script that utilize .NET WebClient methods (DownloadString/DownloadFile) combined with process execution cmdlets (Start-Process/Invoke-Expression/IEX). This pattern is associated with the delivery and execution of the OXLOADER malware via BATPackageBuilderSetup.bat.
This rule detects the use of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin, PowerShell) to disable or delete system recovery features, such as volume shadow copies, backup catalogs, or boot recovery options. These actions are common indicators of malicious activity, particularly ransomware, where an attacker attempts to prevent system recovery before data encryption or destruction.
Detects the creation or modification of a Registry Run key to establish persistence using PowerShell with specific obfuscation techniques. The rule looks for PowerShell commands that include '-NoProfile', '-ExecutionPolicy Bypass', '-WindowStyle Hidden', and '-File', and also references a temporary directory ('AppData\\Local\\Temp'). This combination is often used by adversaries to execute malicious scripts discreetly upon user logon.
Detects the creation or modification of a Registry Run key that executes PowerShell with specific parameters indicating a hidden window, no profile, bypass execution policy, and referencing a script in the AppData\Local\Temp directory. This is a common technique used by adversaries for persistence and to evade detection.
Detects PowerShell execution attempting to interact with AppX packages using 'DiscCoerceProbe'. This activity is often associated with privilege escalation or system manipulation techniques.
Detects PowerShell execution with '-ExecutionPolicy Bypass -File' arguments, combined with specific suspicious file paths or command-line strings often associated with privilege escalation or malicious activity. It also looks for suspicious AppX package management commands.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
This rule detects initial access attempts involving double-extension shortcuts (.lnk) that lead to the execution of VBScript (VBS) files, which subsequently launch PowerShell scripts for decryption. The detection logic specifically looks for a .lnk file executing a command line containing '.vbs', followed within 5 minutes by a PowerShell process executing a command line containing 'Profile.ps1' or '-bxor'. This chain of events is indicative of malicious activity often used in phishing campaigns to bypass security controls and execute obfuscated payloads.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Page 125 of 213