Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
Detects remote PowerShell sessions
Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query is not fully specific to Jupyter or SolarMarker, and will also return other malicious malware, but is unlikely to return false positives.
'Identifies any Azure VM Run Command operations and links these operations with
MDE host logging. Linking these two data sources provides hunting opportunities.
Logging from AzureActivity provides the IP address and UPN of the account that
invoked the command. Joining this with logging from MDE provides insights into
what cmdlets were loaded by the command.'
MDE host logging. Linking these two data sources provides hunting opportunities.
Logging from AzureActivity provides the IP address and UPN of the account that
invoked the command. Joining this with logging from MDE provides insights into
what cmdlets were loaded by the command.'
Detects the execution patterns of the KimJongRAT PE or PowerShell variant loaders, specifically rundll32 executing a DLL from AppData\Local with export 's' or powershell executing '1.ps1' from AppData\Local with '1.log' as an argument.
'Identifies when Azure Run command is used to execute a PowerShell script on a VM that is unique.
The uniqueness of the PowerShell script is determined by taking a combined hash of the cmdLets it imports and the file size of the PowerShell script. Alerts from this detection indicate a unique PowerShell was executed in your environment.'
The uniqueness of the PowerShell script is determined by taking a combined hash of the cmdLets it imports and the file size of the PowerShell script. Alerts from this detection indicate a unique PowerShell was executed in your environment.'
Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.
Detects base64 encoded .NET reflective loading of Assembly
Detects Obfuscated Powershell via use MSHTA in Scripts
Page 174 of 213