Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of the `AgentExecutor.exe` binary when it is used to execute PowerShell scripts. This binary can be abused as a Living Off The Land Binary (LOLBIN) to run PowerShell scripts with the ExecutionPolicy set to "Bypass" or to execute any binary named "powershell.exe" located in a path provided as the 6th positional argument. The rule specifically looks for `AgentExecutor.exe` being executed with command-line arguments indicating PowerShell script execution, such as `-powershell` or `-remediationScript`. It filters out legitimate usage where the parent process is `Microsoft.Management.Services.IntuneWindowsAgent.exe`.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
This rule detects the execution of PowerShell with specific command-line obfuscation patterns known to be used by the CrackMapExec (CME) penetration testing framework. The rule looks for PowerShell executable names and specific string patterns within the command line that CME uses for obfuscation, such as 'join*split', '( $ShellId[1]+$ShellId[13]+''x'')', '( $PSHome[*]+$PSHOME[*]+', '( $env:Public[13]+$env:Public[5]+''x'')', and '( $env:ComSpec[4,*,25]-Join'''')'. These patterns are designed to evade simple string-based detections.
Detects the use of `cmd.exe` to launch PowerShell commands that leverage `clip.exe` and the Windows clipboard for obfuscated execution. This technique is often used to evade detection by breaking up malicious payloads or commands.
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution. This rule specifically looks for common scripting and system utilities being launched as child processes of mshta.exe, which is often abused for defense evasion and execution.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects PowerShell execution that includes base64 encoded WMI class names such as "Win32_ShadowCopy", "Win32_ScheduledJob", "Win32_Process", "Win32_UserAccount", or "Win32_LoggedOnUser" in the command line. This technique is often used by adversaries to obfuscate their actions and evade detection.
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
Detects the creation of a PowerShell module where the module contents specifically include "function Get-VMRemoteFXPhysicalVideoAdapter". This pattern is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. An attacker might use this technique to execute arbitrary code by tricking the legitimate signed binary into loading a malicious PowerShell module.
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
This rule detects PowerShell script execution that attempts to enumerate installed software on a Windows system. Specifically, it looks for the combination of `Get-ItemProperty`, `\software\`, `Select-Object`, and `Format-Table` within the PowerShell script block text. This pattern is commonly used to query the registry for installed applications under `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\` and format the output.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
This rule detects command-line executions that include specific function calls, 'LoadAssemblyFromPath' or 'LoadAssemblyFromNS', which are associated with the 'CL_LoadAssembly.ps1' script. This script can be leveraged to load .NET assemblies, potentially bypassing AppLocker controls and executing arbitrary code. The detection focuses on instances where these function calls are made directly via command-line arguments, such as through PowerShell's '-Command' or '-ScriptBlock' flags.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
Detects the execution of PowerShell where the parent process is suspicious or uncommon. This rule specifically looks for PowerShell being spawned by processes like web servers (tomcat, httpd, nginx, w3wp), database servers (sqlagent, sqlserver, sqlservr), browsers (chrome, firefox, iexplore, microsoftedge, safari, vivaldi, browser.exe, amigo.exe), or other processes not typically expected to launch PowerShell, such as mshta.exe, regsvr32.exe, rundll32.exe, services.exe, jbosssvc.exe, and php-cgi.exe. This pattern can indicate various forms of compromise, including web shell execution, SQL injection leading to command execution, or malicious scripts launched by compromised applications or user interaction.
Page 205 of 213