Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Detects obfuscated PowerShell commands used in service creation events, specifically looking for patterns indicative of Invoke-Obfuscation's VAR++ LAUNCHER technique. The rule identifies service creations where the ImagePath contains specific keywords like '&&set', 'cmd', '/c', '-f', and format specifiers like '{0}', '{1}', etc., which are characteristic of highly obfuscated PowerShell commands often used for defense evasion.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
This rule detects PowerShell commands that use `Get-ChildItem` with `-Recurse` and `-Include` parameters to search for common document and archive file extensions. This behavior is indicative of an adversary attempting to automatically collect sensitive data from a system or network.
Detects suspicious execution of AgentExecutor.exe, a Microsoft Intune component, when it is used to launch PowerShell scripts with potentially bypassed execution policies or to execute a 'powershell.exe' binary from a specified path. This behavior can be indicative of a Living Off The Land Binary (LOLBIN) abuse.
Detects obfuscated PowerShell commands executed via `cmd.exe` using the VAR++ LAUNCHER technique. This method involves using `cmd.exe`'s `&&set` command to define variables that are then used in conjunction with string formatting (`-f` and `{0}` style placeholders) to construct and execute PowerShell commands, often involving `Invoke-Expression` and `DownloadString` for remote code execution.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects the execution of renamed 'cmd', 'powershell', or 'powershell_ise' binaries to 'wermgr.exe'. This technique has been observed in the exploitation of CVE-2023-36874, where attackers disguise legitimate system binaries to evade detection.
Detects the creation of a remote thread from a PowerShell process (powershell.exe or pwsh.exe) into another process. This activity can be indicative of process injection techniques used by adversaries to execute malicious code or evade defenses. A filter is included to exclude known legitimate activity from CompatTelRunner.exe.
This rule detects the creation of a new Windows service (EventID 4697) where the service's file name contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS OBFUSCATION technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either 'system.io.compression.deflatestream' or 'system.io.streamreader'. This combination suggests an attempt to decompress and execute obfuscated PowerShell code.
Detects obfuscated PowerShell execution initiated via rundll32.exe, specifically looking for the combination of 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell' within the ServiceFileName field of Windows Security Event ID 4697 (Service Creation). This technique is often used for defense evasion and to execute malicious PowerShell scripts.
Detects obfuscated PowerShell execution initiated via rundll32.exe. This rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName contains specific keywords indicative of rundll32.exe being used to execute obfuscated commands, potentially involving PowerShell.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicate a remote PowerShell connection, often associated with Windows Remote Management (WinRM). The rule filters out connections from common network service accounts and localhost to reduce false positives.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
This rule detects the installation of a root certificate on a Windows system via PowerShell. It specifically looks for PowerShell script block text containing commands like 'Move-Item' or 'Import-Certificate' targeting the 'Cert:\LocalMachine\Root' path. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Page 203 of 213