Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects a suspicious or uncommon parent processes of PowerShell
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet
Commandline to launch powershell with a base64 payload
Detects a Powershell process that contains download commands in its command line string
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects suspicious PowerShell download command
Page 185 of 213