Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
KQL Query from file: MDE KQL to detect TA571 socialengineering abuse
Identifies suspicious access to sensitive browser files by processes commonly used by Lumma Stealer, expanding coverage to include more browsers based on observed configurations.
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
'This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br>
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Detects the execution of PowerShell by a Microsoft Office application. This behavior is consistent with the UAC-0001 (APT28) campaign described by CERT-UA, where a malicious document's macro was used to launch PowerShell for installing the BEARDSHELL backdoor and COVENANT C2 framework components.
This analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. It leverages PowerShell Script Block Logging (EventCode 4104) to identify specific command patterns associated with Certify's enumeration and exploitation functions. This activity is significant as it indicates potential reconnaissance or exploitation attempts against AD CS, which could lead to unauthorized certificate issuance. If confirmed malicious, attackers could leverage this to escalate privileges, persist in the environment, or access sensitive information by abusing AD CS.
The analytic detects the execution of the Get-GPPPassword or Get-CachedGPPPassword PowerShell cmdlets, which are used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with these cmdlets. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
The analytic detects the use of the `Enter-PSSession` cmdlet to establish an interactive session on a remote endpoint via the WinRM protocol. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity by searching for specific script block text patterns. This behavior is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this activity could allow attackers to execute commands remotely, potentially leading to further compromise of the network and unauthorized access to sensitive information.
This analytic detects PowerShell scripts that create thread mutexes, identified by the presence of "Threading.Mutex" in PowerShell Script Block Logging (EventCode 4104). This technique is often used by malware to ensure only a single instance of a malicious script runs on a compromised system, which can indicate sophisticated malware or persistence mechanisms. Such activity could allow an attacker to maintain exclusive control over a process, potentially leading to further exploitation or persistence within the environment.
This analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
This analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
This analytic detects the execution of the `Get-ForestTrust` command, often associated with the PowerSploit framework, via PowerShell Script Block Logging (EventCode=4104). This activity is significant because `Get-ForestTrust` is used to enumerate trust relationships within an Active Directory forest. Adversaries commonly perform this discovery technique as a precursor to lateral movement or privilege escalation, aiming to map out the environment for further exploitation and access to sensitive resources. Detecting this command provides visibility into potential reconnaissance efforts by attackers.
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
This analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. It specifically looks for PowerShell Script Block Logging (EventCode=4104) events containing `adsisearcher`, `objectcategory=computer`, and methods like `findAll()` or `findOne()`. This activity is indicative of Active Directory discovery, which adversaries or Red Teams perform to gain situational awareness and identify potential targets for lateral movement.
The analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
Detects base64 encoded .NET reflective loading of Assembly
This analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). This cmdlet lists network connections on a system, which adversaries may use for situational awareness and network discovery. Monitoring this activity is crucial as it can indicate reconnaissance efforts by an attacker. If confirmed malicious, this behavior could allow an attacker to map the network, identify critical systems, and plan further attacks, potentially leading to data exfiltration or lateral movement within the network.
The analytic detects the use of the `Set-ADAccountControl` PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific command execution. Disabling Kerberos Pre-Authentication is significant because it allows adversaries to perform offline brute force attacks against user passwords using the AS-REP Roasting technique. If confirmed malicious, this activity could enable attackers to escalate privileges or maintain persistence within an Active Directory environment, posing a severe security risk.
Page 170 of 213