Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects PowerShell (powershell.exe or pwsh.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Detects PowerShell execution patterns consistent with the ClickFix malware campaign, which uses obfuscated scripts to decrypt and reflectively load a .NET assembly in memory. This activity is detailed in Stage 2 of the infection chain. The query identifies command lines with combinations of keywords used for decoding, decryption, and in-memory execution, specifically looking for 'FromBase64String' combined with 'Reflection.Assembly' and 'Load' for reflective loading, 'FromBase64String' and '-bxor' for XOR decryption, or 'FromBase64String' and 'Invoke-Expression'/'IEX' for executing decoded scripts in memory.
Water Gamayun Group is actively exploiting Windows MMC vulnerability to deliver hidden PowerShell payloads and final malware loaders.
Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance
Detects the creation of known offensive powershell scripts used for exploitation
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects when Visual Studio Code or its extension host spawns PowerShell, CMD, or similar interpreters (possible SleepyDuck payload execution).
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects various activities associated with the DRAYN malware family, as described in a detailed analysis. This includes stealthy installation command-line arguments, PowerShell-based system reconnaissance, and modification of file permissions for defense evasion.
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Detects remote command execution via PowerShell's Invoke-Command, a technique used by The Gentlemen ransomware for lateral movement and deploying payloads.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Detects powershell.exe execution from non-standard parent processes or atypical file system locations, a behavior often associated with ClickFix social engineering attacks.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects the use of a PowerShell download cradle, a technique observed in the PhantomCaptcha campaign to download and execute a next-stage payload. This pattern often involves stealthy flags to evade detection.
Page 156 of 213