Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects unusually long PowerShell command lines with a length of 1000 characters or more
Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
Detects powershell execution with that make use of to the bxor (Bitwise XOR).
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Clip.exe to execute PowerShell
Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.
APT29
Sigma
This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks.
Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets
'Finds PowerShell execution events that could involve a download'
PowerShell Execution
Sigma
Detects execution of PowerShell
'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
Detects Obfuscated Powershell via RUNDLL LAUNCHER
'Looks for Base64-encoded commands associated with the Nishang reverse TCP shell.
Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'
Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'
Detects Obfuscated Powershell via use Rundll32 in Scripts
Page 187 of 213