Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the use of the AADInternals PowerShell module, a tool used by threat actors like MERCURY and DEV-1084 for credential theft and privilege escalation in Azure AD environments.
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (V4dC5FbmNvZ) in DNS TXT Reponse
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
This rule detects HTTP GET requests to github.com for PNG files where the User-Agent header contains "WindowsPowerShell". This combination could indicate an attempt to download malicious content or C2 instructions disguised as an image file using PowerShell.
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
Detects PowerShell command clobbering techniques, where a module is installed or imported with the intent to overwrite existing system commands. This can be used in supply chain attacks via repositories like PowerShell Gallery.
Page 157 of 213