Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects suspicious PowerShell invocation command parameters
Detects keywords from well-known PowerShell exploitation frameworks
Detects Obfuscated Powershell via RUNDLL LAUNCHER
PowerShell PSAttack
Sigma
Detects the use of PSAttack PowerShell hack tool
PowerShell ShellCode
Sigma
Detects Base64 encoded Shellcode
Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.
WMImplant Hack Tool
Sigma
Detects parameters used by WMImplant
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
Detects PowerShell called from an executable by the version mismatch method
Detects usage of "xor" or "bxor" in combination of a "foreach" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection
Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries
Detects new commands that add new printer port which point to suspicious file
Detects execution of ChromeLoader malware via a registered scheduled task
Detects suspicious PowerShell invocation with a parameter substring
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.
Detects usage of a base64 encoded "IEX" cmdlet in a process command line
Page 181 of 213