Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects PowerShell processes attempting to retrieve or execute content from a remote RTF (Rich Text Format) resource. It specifically looks for PowerShell commands like 'Invoke-WebRequest', 'iwr', 'DownloadString', 'Invoke-Expression', or 'iex' that are directed towards a URL ending with '.rtf'. This behavior is often associated with malicious activity where RTF files are used as a delivery mechanism for scripts.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
This rule detects suspicious command-line execution originating from common web browsers. It identifies instances where a browser process launches a command-line interpreter (cmd, powershell, or wscript) and immediately invokes known download or utility commands (curl, iwr, bitsadmin, certutil), which is a common pattern for file-less or stage-two payload delivery from malicious websites.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects the simultaneous extraction of at least three different script types (VBS, PS1, JS, or DAT) from archives, followed by their execution by their respective interpreters (wscript.exe, powershell.exe, node.exe, or bun.exe). This behavior is indicative of multi-stage attacks where adversaries use various scripting languages for different phases of their operations, often to evade detection or to ensure compatibility across different system configurations. The inclusion of '.dat' files suggests that the rule is also looking for potentially obfuscated or custom script formats that are then interpreted by one of the listed executables.
Detects anomalous node.exe execution initiated by command-line shells (cmd.exe or powershell.exe) where the command line contains either '-e' (for evaluating JavaScript code) or '.js' (indicating a JavaScript file execution). This behavior is associated with the NodeSnake cross-platform downloader, which uses Node.js to execute its payload, as observed in campaigns linked to Interlock and Rhysida.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Detects execution of PowerShell with encoded commands, often used in malicious scripts.
Correlates the Get-Clipboard cmdlet execution natively invoked by the user shell, proving the "paste-to-run" ClickFix mechanism. This rule specifically looks for PowerShell execution of 'Get-Clipboard' where the initiating process is 'explorer.exe'.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Detects the execution of PowerShell with the '-WindowStyle Hidden' flag, specifically when initiated by 'explorer.exe', which is a known tactic used by the ClickFix malware to mask its payload execution.
Detects the invocation of the 32-bit PowerShell executable (from SysWOW64) via cmd.exe with a Base64 encoded command, which can be used to bypass 64-bit hooks and execute malicious payloads.
Detects PowerShell commands that modify Quality of Service (QoS) policies targeting the 'ActiveStore'. This technique can be used by adversaries to apply throttling to processes, potentially bypassing EDR solutions without requiring a system reboot, as described in the EDRChoker playbook.
Detects QoS policy creation with a throttle rate applied, targeting EDR disconnection via extreme low bandwidth. This rule specifically looks for PowerShell commands that include 'ThrottleRateActionBitsPerSecond' in their additional fields, indicating an attempt to set a very low bandwidth throttle.
Detects enumeration of existing QoS policies via PowerShell, potentially used by attackers to verify throttling. This rule specifically looks for the execution of the 'Get-NetQosPolicy' command within PowerShell.
Detects copying executables, scripts, or archives to a remote C$ share immediately before remote execution. This behavior is associated with the 'Gentlemen Ransomware' as described in the referenced Microsoft blog.
Page 127 of 213