Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects the execution of PowerShell scripts located in the 'WMILoad' directory, specifically targeting 'ClockRemoval.ps1'. This script is the core AV killer component of the Dragon Boss multi-stage attack chain used to neutralize security controls.
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects the classic Matt Graeber AMSI bypass technique using reflection to set amsiInitFailed to True. This one-liner disables AMSI scanning for the entire PowerShell session.
Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.
This technique is often abused by attackers to download additional payloads.
Detects the use of PowerShell's BitsTransfer module to download a payload named "syncobs.exe". This specific file and behavior are associated with the REF6598 campaign, where it is used as a secondary staging mechanism to deliver the PhantomPull in-memory loader and ultimately the PhantomPulse RAT.
Detects instances where the legitimate Obsidian application spawns shell or scripting interpreters (PowerShell, cmd, sh, bash, zsh). This behavior is associated with the REF6598 campaign, where attackers abuse the Obsidian "Shell Commands" community plugin to execute malicious code and deliver the PhantomPulse RAT.
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.
The "--headless" flag hides the windows from the user upon execution.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Detects the secondary staging mechanism used by the intermediate PowerShell script before the PhantomPull in-memory loader is executed. This rule specifically looks for PowerShell or PowerShell Core processes executing commands that utilize `Start-BitsTransfer` to download a file named `syncobs.exe`.
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects base64 encoded .NET reflective loading of Assembly
Page 140 of 213