Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects WMI abuse for lateral movement, remote execution, and persistence.
Using native WMI, and one condition for PowerShell plus WMI queries
Using native WMI, and one condition for PowerShell plus WMI queries
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
Detects a PowerShell process reading the content of a batch script named 'rEgX.cmd' to extract an appended payload. This technique is used by the DeadVax malware as part of its stage 3 execution.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects the creation of scheduled tasks with specific names and command-line patterns associated with the BadPaw PowerShell backdoor. This technique is used by the threat actor to establish persistence on the compromised system.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects PowerShell attempting to read a specific batch file named 'rEgX.cmd' using Get-Content, a signature behavior of the Dead#Vax self-parsing loader. This technique is used to extract a hidden payload from the script itself.
Detects the execution of script interpreters (wscript.exe, cscript.exe, cmd.exe, powershell.exe) where the script file being executed resides on a newly mounted virtual disk volume (VHD, ISO, etc.).
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
Detects the execution of a PowerShell command intended to read the content of the batch script that launched it.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
Detects a PowerShell command used to read its own batch script container (e.g., rEgX.cmd) to find and extract a hidden, encoded payload. This self-parsing technique is a core feature of the Dead#Vax malware.
Detects a specific PowerShell command pattern used by the DeadVax malware campaign. The malware uses a self-parsing technique to read its own batch script file and extract a hidden, encoded payload from lines starting with an '@' character.
Detects a PowerShell script attempting to read the content of a command or batch file (.cmd) to extract a payload. This technique was observed in the DeadVax campaign where a batch script invokes PowerShell to parse its own content, looking for a line starting with '@' which contains the next stage's Base64-encoded payload.
Detects a PowerShell process reading its own or another script's content to extract a hidden payload. This technique was observed in the Dead#Vax campaign to deobfuscate and execute payloads stored within the script file itself.
Detects the execution of a scheduled task characteristic of the GhostWeaver RAT. The malware's persistence mechanism involves a hidden task that executes PowerShell via 'conhost --headless' and often uses a task name that mimics legitimate PowerShell cmdlets to blend in.
This rule detects various stages of the VOID#GEIST multi-stage Python loader as described in the Securonix blog. It identifies initial batch file execution, Chrome decoy PDF lures, hidden PowerShell relaunching of the batch file, persistence via the Startup folder, curl commands downloading zip payloads, Python embedded runtime downloads, and final Python payload execution. The rule is designed to catch the distinct command-line patterns associated with each stage of this specific malware.
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
Page 147 of 213