Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
330
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,043
669
277
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects instances where PowerShell is invoked, and there's a mismatch between the PowerShell engine version and the host version. Specifically, it looks for PowerShell classic start events where the 'Data' field contains an 'EngineVersion' of 2, 4, or 5, while simultaneously containing a 'HostVersion' of 3. This version mismatch can indicate attempts to evade detection or exploit vulnerabilities by using an older or specific PowerShell engine version within a newer host environment.
Detects suspicious PowerShell invocation command parameters such as encoded commands, hidden window styles, and non-interactive modes. These parameters are frequently used by adversaries to obfuscate malicious scripts, execute them stealthily, or prevent user interaction.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
This rule detects the execution of PowerShell scripts where the script path explicitly includes or references the "C:\Users\Public" directory. This directory is often used by adversaries to store and execute malicious scripts due to its default write permissions for all users, making it a common location for staging and executing payloads.
Detects the creation of a PowerShell process (powershell.exe or pwsh.exe) as a child of WmiPrvSE.exe. This activity is indicative of potential lateral movement or execution via Windows Management Instrumentation (WMI), where WMI is used to spawn a PowerShell process on a system.
Detects activity associated with the Tropic Trooper campaign from November 2018, specifically looking for a distinct command-line string used by the threat actor. This rule targets a specific pattern in process command lines that indicates the execution of malicious code or scripts by Tropic Trooper, an actor known for targeting organizations in the energy and food and beverage sectors in Asia.
This rule detects specific command-line patterns associated with FIN7's reconnaissance and POWERTRASH execution, as reported by WithSecureLabs. It looks for PowerShell commands that include '-noni -nop -exe bypass -f \\' and 'ADMIN$' or '-ex bypass -noprof -nolog -nonint -f' and 'C:\Windows\Temp\'. These patterns indicate attempts to execute PowerShell scripts, potentially for remote access or privilege escalation, often targeting administrative shares or temporary directories.
This rule detects the use of specific Windows API (WinAPI) libraries within PowerShell scripts. Attackers often leverage direct WinAPI calls from PowerShell to bypass typical detection mechanisms that focus on standard PowerShell function calls. The rule specifically looks for the presence of 'Advapi32.dll', 'kernel32.dll', 'KernelBase.dll', 'ntdll.dll', 'secur32.dll', and 'user32.dll' within the PowerShell script block text. This can indicate attempts to perform low-level system operations or interact with the operating system in a way that might evade higher-level monitoring.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.
Detects the execution of ADRecon.ps1, a PowerShell script used for Active Directory reconnaissance. The rule identifies specific function names and a default report filename commonly found within the ADRecon script. This tool has been reported to be actively used by the FIN7 threat group.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
This rule detects suspicious PowerShell process creations that include base64 encoded commands. It looks for PowerShell or pwsh executables being launched with the '-e', '-en', or '-enc' command-line arguments, combined with specific base64 encoded strings commonly associated with malicious activity (e.g., ' JAB', ' SUVYI', ' SQBFAFgA', ' aQBlAHgA', ' aWV4I', ' IAA', ' IAB', ' UwB', ' cwB'). It also includes a standalone detection for '.exe -ENCOD ' and ' BA^J e-' (reversed). This pattern is often used by malware like Emotet to obfuscate their command-and-control instructions or payloads.
Detects the execution of PowerShell commands that contain reversed strings, a common obfuscation technique used by attackers to evade detection. The rule specifically looks for PowerShell or pwsh.exe processes where the command line contains reversed versions of common PowerShell keywords or commands, while excluding commands that use standard encoded command parameters to reduce false positives.
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
Page 201 of 213