Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects PowerShell preparing to execute shellcode using the CallWindowProc API. This technique is used to bypass EDRs by executing code without creating a new thread, which is a commonly monitored API call.
Detects command line obfuscation using carets (^) in Windows interpreters like cmd.exe and PowerShell.
The analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript. It leverages Windows Security EventCode 4698 to identify when such tasks are registered. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
This rule detects commands executed via the Run dialog (Win+R), which is often used by attackers or malicious scripts to launch tools like PowerShell, cmd, or other malicious payloads. It specifically looks for modifications to the 'RunMRU' registry key by 'explorer.exe' that contain suspicious keywords or patterns indicative of command execution, especially in scenarios like ClickFix-style attacks where users are tricked into running commands.
Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.
This KQL rule detects commands executed via the Run dialog by monitoring changes to the "Runmru" registry key. This key stores a history of commands entered into the Run dialog. Attackers or malicious scripts often use this method to launch tools like PowerShell, cmd, or malicious payloads, particularly in social engineering attacks where users are tricked into running commands.
This rule detects the creation or modification of registry values within common Auto-Start Extensibility Point (ASEP) Run keys. It specifically flags entries that point to suspicious file paths (e.g., C:\Users\Public\, C:\ProgramData\, temporary directories) or contain suspicious command-line interpreters (e.g., rundll32, mshta.exe, powershell.exe, wscript.exe, cscript.exe). The rule filters out modifications made by known legitimate processes to reduce false positives.
This rule detects PowerShell command line execution by user accounts. It specifically looks for `PowerShellCommand` events where the `InitiatingProcessFileName` is `powershell.exe` and the `InitiatingProcessAccountName` is not 'system'. It also ensures that both `ProcessCommandLine` and `InitiatingProcessCommandLine` are not empty. This helps monitor PowerShell usage across endpoints, detect suspicious or unauthorized script execution, and investigate potential lateral movement or remote access.
This rule detects potential obfuscated or stealthy PowerShell execution by identifying PowerShell commands that do not use the default 'powershell' or 'pwsh' executable names but still contain common PowerShell command-line arguments such as '-NoProfile', '-ExecutionPolicy', or 'Invoke-Expression'. It correlates these executions with user logon sessions to aid in attribution and threat hunting.
This rule detects PowerShell activity on user workstations within 30 minutes of receiving an email from a known malicious sender. It aims to identify potential post-compromise activity initiated by a successful phishing attempt.
The analytic identifies the execution of PowerShell scripts from the WindowsApps directory, which is a common technique used in malicious MSIX package execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command lines and parent process paths. This activity is significant as adversaries have been observed using MSIX packages with embedded PowerShell scripts (particularly StartingScriptWrapper.ps1) to execute malicious code. If confirmed malicious, this could allow attackers to execute arbitrary code, establish persistence, or deliver malware while evading traditional detection mechanisms.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects reflective loading of .NET assemblies from memory within PowerShell. This technique is often used to execute malicious code while bypassing file-based detections and some AMSI features, as the assembly is loaded directly from a byte array rather than from a file on disk.
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
Adversaries often use malicious macros embedded in Office documents (Word, Excel) to execute payloads often spawning PowerShell, cmd, or LOLBins. This rule detects macro-triggered process chains indicative of weaponized documents.
Detects MucorAgent, a multi-stage .NET backdoor used by the Curly COMrades threat actor. It uses COM hijacking for persistence and executes AES-encrypted PowerShell scripts.
Detects the execution of PowerShell commands from a headless ConHost process. The '--headless' flag is used to hide the console window from the user, which can be leveraged by adversaries for stealthy execution.
This rule detects PowerShell script blocks that attempt to bypass AMSI (Antimalware Scan Interface) by patching or manipulating memory related to AMSI. It specifically looks for the presence of keywords like 'VirtualProtect', 'GetProcAddress', 'InteropServices', 'AmsiScanBuffer', and references to 'amsi.dll' or 'clr.dll' within PowerShell operational logs (EventID 4104). This combination of keywords indicates an attempt to programmatically interfere with AMSI's ability to scan script content.
This detection identifies instances where PowerShell is executed using a legacy engine version (e.g., v2.0), which lacks support for AMSI and script block logging. Attackers often downgrade PowerShell to avoid modern security controls and to evade detection during payload execution.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
Detects PowerShell obfuscation techniques in process command lines, including encoded commands, IEX with string manipulation, and long command lines with string functions, indicating potential malicious activity. The rule specifically looks for the use of '-encodedcommand' or its short forms with long command lines, 'iex' or 'invoke-expression' combined with string manipulation (like '+', '-join', '[char]', 'frombase64string') or very long command lines, and unusually long command lines that also contain string manipulation functions ('-join', 'replace', 'split').
Page 165 of 213