Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the usage of the Windows native Cipher tool within PowerShell or cmd.exe to wipe the contents of the C Drive. The rule specifically looks for the 'cipher /W:C' command, which is used to remove data from available unused disk space on the C: drive, making previously deleted data unrecoverable.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
Detects the execution of PowerShell, VBScript, PHP, JavaScript, or WSF scripts from the 'AppData\Local\Temp' directory by common Windows processes like explorer.exe or svchost.exe. This behavior can indicate malicious activity where scripts are dropped into temporary locations and then executed.
Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.
Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
This analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as Base64 encoding is often used by attackers to obfuscate malicious payloads, making it harder to detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system.
The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
This rule detects the creation of suspicious child processes by 'KeyScrambler.exe'. KeyScrambler is legitimate software designed to encrypt keystrokes, but if compromised, it could be used to launch malicious binaries. The rule specifically looks for 'KeyScrambler.exe' as a parent process launching common Windows utilities often abused by attackers, such as 'cmd.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe', 'pwsh.exe', 'regsvr32.exe', 'rundll32.exe', and 'wscript.exe'. This behavior could indicate an attacker leveraging a compromised KeyScrambler process for execution, defense evasion, or privilege escalation.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a PowerShell command. The PowerShell command specifically attempts to retrieve a base64 encoded payload from the Windows Registry (HKCU or HKLM hive) and execute it. This technique is often used by adversaries for persistence and to evade detection by obfuscating the malicious payload.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
Detects PowerShell command-line execution with unusual or randomized character casing for keywords like "powershell" or "-noprofile". This is a common obfuscation technique used by attackers to evade basic, case-sensitive detections. This rule is inspired by the THOR PowerShell_Case_Anomaly Yara rule.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.
Page 160 of 213