Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects the creation of named pipes by alternate PowerShell hosts, which might be used to bypass detections specifically looking for `powershell.exe`. This rule identifies processes that create named pipes starting with '\PSHost' but are not the standard PowerShell executables or other common legitimate processes that might use such pipes.
Detects attempts to change the PowerShell script execution policy to a less secure level (Bypass or Unrestricted) using the '-ExecutionPolicy' flag. This can be abused by adversaries to execute unsigned or malicious scripts.
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.
This rule detects PowerShell or pwsh.exe process creations that include command-line arguments indicative of image file manipulation and obfuscation techniques. Specifically, it looks for the presence of image file extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif) combined with PowerShell commands or .NET methods related to base64 decoding, expression invocation, command invocation, GDI+ graphics operations (System.Drawing, Bitmap, GetPixel, SetPixel, LockBits, UnlockBits, PixelFormat), or file content reading ([IO.File]::ReadAllBytes, Get-Content). Additionally, it checks for common obfuscation or execution flags such as '-enc', '-encoded', '-e', '-w hidden', '-windowstyle hidden', '-nop', '-noprofile', '-ep bypass', or '-executionpolicy bypass'. This combination suggests an attempt to execute malicious code hidden within image files, often using steganography or other covert methods.
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
Detects a Powershell process that contains download commands in its command line string
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
Detects the use of various CLI utilities exfiltrating data via web requests
Detects the execution of an encoded PowerShell command where the parent process is w3wp.exe. This behavior is often indicative of an attacker leveraging a compromised web server (IIS) to execute malicious PowerShell scripts, potentially for further reconnaissance, privilege escalation, or payload delivery. The rule includes exclusions for known legitimate PowerShell scripts to reduce false positives.
This query groups all files by their originating file—such as a ZIP archive or from a Website—and includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify:
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
Detects when a command-line interpreter (cmd.exe or powershell.exe) writes or modifies a file within a SharePoint \TEMPLATE\LAYOUTS directory. This activity is suspicious as it could indicate an attempt to deploy a web shell or other malicious code to gain persistent access or execute commands on the SharePoint server. The rule specifically excludes a known legitimate SharePoint automation script to reduce false positives.
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. This rule specifically looks for `conhost.exe` spawning `cmd.exe`, `cscript.exe`, `mshta.exe`, `powershell_ise.exe`, `powershell.exe`, `pwsh.exe`, `regsvr32.exe`, or `wscript.exe`.
Detects the IIS worker process (w3wp.exe) spawning suspicious child processes like command shells or reconnaissance tools. This is a common post-exploitation pattern observed after compromise of web applications, particularly Microsoft Exchange Server.
Detects the use of PowerShell cmdlets (`Get-LocalGroup`, `Get-LocalGroupMember`) or WMI queries (`Get-WmiObject`, `Get-CimInstance` targeting `Win32_Group`) to gather local group information. Adversaries commonly use these methods to discover local system permission groups and identify users with elevated privileges, such as local administrators.
Yara rule that detects Veaty backdoor.
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects a PowerShell process launch shortly after a .LNK file was created by Discord. This pattern is indicative of malicious LNK files distributed via Discord to gain initial execution.
Page 163 of 213