Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,222
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell with suspicious command-line flags (EncodedCommand, NoProfile, WindowStyle Hidden, ExecutionPolicy Bypass) combined with either potential Base64-encoded payloads or network-based download cradles (e.g., Invoke-Expression, WebClient).
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects a sequence of events on a single device involving a remote MSI installation followed by PowerShell-based process elevation and administrative checks using fltmc.exe. This pattern is indicative of an attacker attempting to deploy malicious packages remotely and escalate privileges within the environment.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
This rule detects potentially malicious command execution initiated by web browsers (Chrome, Edge, Firefox, Safari, Opera). It identifies scenarios where browsers spawn PowerShell on Windows with encoded command arguments or spawn shells (zsh, bash, sh) on macOS while piping commands retrieved via curl or wget, which is a common pattern for dropper and fileless malware delivery.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
Detects potential abuse of Windows Management Instrumentation (WMI) for process execution. It monitors for wmic.exe creating processes, PowerShell cmdlets Invoke-WmiMethod or Invoke-CimMethod used for remote execution, and unexpected process spawns from the WmiPrvSE.exe provider service, which are common indicators of lateral movement and remote command execution.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell by identifying specific commands used to manipulate the AmsiUtils class or its field values in memory.
Detects UAT-11587 diplomatic-lure LNK file exploiting ZDI-CAN-25373 whitespace padding to conceal a PowerShell command that extracts CanonStager (cnmpaui.exe/dll) from TAR archives into %TEMP%
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the Kothamine post-installation technique where npm/node spawns PowerShell to reflectively load a .NET assembly stager into memory. This behavior is followed by the PowerShell process spawning anomalous instances of RuntimeBroker.exe or svchost.exe. These spawned processes exhibit suspicious characteristics, such as executing from non-standard file paths, having missing command-line arguments (like the required '-k' for svchost), or having an illegitimate parent process (powershell.exe) instead of standard system parents like services.exe or wininit.exe.
Page 18 of 213