Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
This rule detects the execution of PowerShell with an execution policy bypass, specifically looking for a command line that includes 'AzureRemove-NetNatStaticMapping.ps1' and 'AppActions'. This combination is indicative of the KongTuke malware's second-stage loader, which uses a PowerShell script to load a DPAPI-unprotected payload.
Detects PowerShell execution containing multiple repeated empty-string literal patterns such as "" or '' (including variants with whitespace), often used in trivial string-obfuscation techniques observed in malicious scripts. The regex is greedy so per environment tuning may be necessary.
Detects default file names outputted by the BloodHound collection tool SharpHound
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
This rule detects the execution of 'finger.exe' with a command line containing an '@' symbol, which is indicative of ClickFix campaigns fetching obfuscated PowerShell payloads. Legitimate use of 'finger.exe' is rare on Windows, making this a high-fidelity detection for ClickFix delivery.
This rule detects network connections to known Remote Monitoring and Management (RMM) tool domains initiated by `cmd.exe` or `powershell.exe`. This behavior can indicate the unauthorized use of RMM tools by an adversary to gain remote access and control over a compromised system. The rule specifically looks for successful network connections where the remote URL matches a URI from a curated list of RMM domains, and the initiating process is either `cmd.exe` or `powershell.exe`, excluding a specific bypass command line.
Detects suspicious child processes spawned by the SolarWinds Web Help Desk (WHD) service. This behavior was observed during the active exploitation of vulnerable WHD instances as reported by Microsoft.
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
PowerShell (parent explorer) launches WScript with minimized window and Invoke-WebRequest. Lampion campaign pattern per Microsoft blog.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
Detects the PowerShell download cradle used by the Marco Stealer malware.
Detects PowerShell spawned by explorer.exe with extensive whitespace padding followed by comment characters and fake document paths. This technique is used in social engineering attacks where victims are instructed to paste commands into File Explorer, with malicious code hidden by whitespace and a visible fake path comment (e.g., "# C:\Documents\policy.docx") to appear benign.
Detects PowerShell download cradles that use commands like Invoke-RestMethod, Invoke-WebRequest, iwr, irm, curl, wget, Net.WebClient, DownloadString, DownloadData, or Start-BitsTransfer to download content, immediately followed by execution via Invoke-Expression or IEX. This technique is often used for fileless malware execution.
Detects PowerShell scripts that perform a multi-stage obfuscation pattern involving the decompression of data using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream', followed by base64 decoding using 'FromBase64String' or 'Convert::FromBase64', and finally loading the resulting payload as a .NET assembly using 'Reflection.Assembly' or 'Assembly]::Load'. This combination of actions is indicative of malware delivery techniques.
This rule detects suspicious PowerShell commands that are written to the Windows registry. It specifically looks for registry events where the 'Details' field contains keywords indicative of PowerShell execution ('powershell', 'pwsh') combined with suspicious command elements. These suspicious elements include obfuscation flags or download capabilities such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', 'Net.WebClient', 'FromBase64String', '-w hidden', '-windowstyle hidden', '-ep bypass', '-executionpolicy bypass', '-enc ', and '-encodedcommand'. The presence of such commands in the registry may indicate a persistence mechanism, a configuration backdoor, or automated malware execution.
Detects PowerShell execution where the window is hidden, combined with suspicious commands such as encoded payloads, direct execution of expressions (iex, Invoke-Expression), web requests (DownloadString, iwr, Invoke-WebRequest), base64 decoding (FromBase64String), or execution policy bypass. The rule specifically excludes legitimate application package management operations involving 'AppxPackage' and certain Visual Studio Code (VS Code) installer and process management activities.
Detects PowerShell loading .NET assemblies into memory (not from disk) via reflection from suspicious sources including base64-encoded data, web downloads, or compressed streams. This pattern indicates fileless malware execution or post-exploitation tool delivery.
Page 152 of 213