Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects PowerShell processes executing commands that include base64 decoding (FromBase64String), invoking expressions (IEX), creating web client objects (New-Object Net.WebClient), and making HTTP/HTTPS requests. This combination is often indicative of malicious PowerShell activity, such as downloading and executing payloads from remote servers, potentially obfuscated.
Detects common LOLBins spawned by Microsoft Office applications, indicating potential macro-based initial access leading to execution
This rule detects the execution of PowerShell with encoded commands. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for 'powershell.exe' in the process filename and either '-enc' or '-encodedcommand' in the command line, while excluding known legitimate uses by 'Windows Defender'.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
This rule detects when a Microsoft Office application (Word, Excel, PowerPoint) spawns a command interpreter (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute commands on the system.
This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.
Detects the execution of PowerShell that has been renamed to 'wt.exe', matching the Axios RAT Windows payload behavior. This rule identifies processes masquerading as Windows Terminal (wt.exe) but whose underlying executable is actually PowerShell.
This rule detects the execution of suspicious filenames (FunnyApp.exe, RedSun.exe, undef.exe, z.exe, powershell.exe) from common user download or pictures directories. Adversaries often place malicious executables in these locations to evade detection and execute their payloads.
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects the Windows Server Update Services (WSUS) worker process (w3wp.exe) or service (wsusservice.exe) spawning command-line tools like cmd.exe or powershell.exe. This behavior is highly anomalous and strongly indicates a successful compromise, such as post-exploitation activity related to the WSUS Unauthenticated RCE (CVE-2025-59287).
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
Detects Python executables spawning shell interpreters such as cmd.exe or powershell.exe. This activity is indicative of the SNOWBASIN local HTTP bindshell proxying and executing remote commands on the host system on behalf of the attacker, as observed in UNC6692 campaigns.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
This rule detects the use of PowerShell to re-enable the Server Message Block version 1 (SMB1) protocol on Windows systems. SMB1 is a deprecated and insecure protocol, and its re-enablement often indicates an attempt to support legacy systems or could be exploited by adversaries for lateral movement or data access.
Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Page 139 of 213