Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the initial PowerShell command users are instructed to paste and run from the Windows Run dialog following a Microsoft Teams social engineering lure to deploy ModeloRAT. This rule specifically looks for PowerShell execution that downloads content from 'dropbox.com' using 'iwr' (Invoke-WebRequest), extracts an archive using 'Expand-Archive', and targets the 'appdata' directory.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Detects programmatic file access in Microsoft 365/SharePoint environments where the operation is logged as 'FileAccessed' but the UserAgent indicates a scripting library like python-requests or PowerShell. This behavior is indicative of data exfiltration techniques used by actors like UNC6671 (BlackFile) who stream file content directly to bypass traditional 'FileDownloaded' monitoring.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with matanbuchus 3.0 loader.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
Detects the variable splitting technique in cmd.exe specifically designed to obfuscate the invocation of PowerShell (e.g., set x=pow&&set y=ershell). This technique is used in the InstallFix campaign to bypass static command-line monitoring.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Detects cmd.exe spawning PowerShell to download a file using System.Net.WebClient to the Windows Temp directory. This pattern was observed in the DAEMON Tools supply chain attack to drop secondary payloads.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdate' that leverages PowerShell to download and execute a payload. This technique was observed in an Iranian-Nexus operation against Oman's government.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
This rule detects suspicious command-line patterns indicative of obfuscation, encoding, or stealth techniques often used by adversaries. It scores various characteristics such as hidden window styles, variable manipulation, string operations, and decoding functions (e.g., Base64, Gzip, Deflate). The rule filters out known legitimate processes and command-line boilerplate to reduce false positives and classifies detections based on the highest scoring obfuscation category.
This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.
This rule detects PowerShell commands indicative of reflective code loading, specifically looking for the use of 'Assembly' and 'Load' or 'GetType' and 'Invoke' within PowerShell command arguments. It filters out common noise associated with legitimate PowerShell operations like PSGet, Cursor, and internal Microsoft PowerShell modules to reduce false positives.
Detects the explicit loading of the Exchange Management snap-in by PowerShell, often a precursor to mailbox exfiltration as seen in SHADOW-EARTH-053 activity. This activity can indicate an adversary is preparing to interact with Exchange mailboxes.
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
Detects PowerShell commands attempting to query the Terminal Services Remote Connection Manager event log for Event ID 1149. This may indicate adversary reconnaissance of RDP connection history to identify targets for lateral movement.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Page 138 of 213