Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
XWorm PE
YARA
YARA rule that detects XWorm malware based on common indicators like PowerShell usage and embedded Mozilla-style User-Agent strings.
Detects PowerShell commands using string reversal techniques and specific numeric padding, methods observed in Kimsuky's "ClickFix" campaigns to obfuscate malicious code. The rule looks for a combination of PowerShell string manipulation functions and a unique numeric string.
This hunt looks for PowerShell being executed as a child or grandchild of mshta.exe or network events initiated by PowerShell as a child of mshta.exe.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
There are two ways to approach this:
Look for device network events initiated by PowerShell with a parent of mshta.exe
Look for process events where PowerShell is executed with a parent process of mshta.exe
The search in this hunt leverages the second approach.
You could also look for PowerShell command lines making web requests but the obfuscation employed by known threat actors makes this more difficult to find by matching strings.
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
Detects various initial access TTPs associated with the "ClickFix" attack vector, where users are tricked into running malicious commands. This includes behaviors observed in Lumma Stealer, Latrodectus, and NetSupport RAT campaigns.
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
KQL Query
Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance
Detects potential misuse of TryCloudflare tunnels for malware delivery or C2 communication by monitoring command-line arguments of common scripting and download tools. Adversaries leverage legitimate services like TryCloudflare to host malicious payloads and evade detection.
This detection identifies attempts to execute PowerShell commands that have been obfuscated using Base64 encoding. Attackers frequently employ Base64 encoding to conceal malicious scripts, evade signature-based antivirus solutions, and make it more difficult for security analysts to quickly understand their true intent.
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Detects the creation of known offensive powershell scripts used for exploitation
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects the creation of known offensive PowerShell scripts used for exploitation, reconnaissance, credential access, persistence, and other malicious activities. The rule identifies specific filenames associated with popular PowerShell offensive security frameworks and tools.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
KQL Query
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.
Page 168 of 213