Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the execution of PowerShell commands that utilize base64 encoded 'IEX' (Invoke-Expression) cmdlets. Adversaries often encode malicious PowerShell scripts in base64 to evade detection and obfuscate their intentions. The rule specifically looks for patterns indicative of base64 encoded 'IEX' calls, including variations with 'New-Object' and different casing, as well as UTF-16 LE encoded versions of common 'IEX' patterns.
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process". This technique can be used to bypass application control and execute malicious code.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.
Detects PowerShell command line contents that include suspicious abnormal casing in the 'Net.Webclient' string (e.g., 'nEt.WEbCliEnT') as used in obfuscation techniques. This rule specifically looks for base64 encoded variations of 'Net.Webclient' with mixed casing, indicating an attempt to evade detection.
Detects attempts to tamper with the PowerShell execution policy by modifying registry keys via the command line. This technique is often used by adversaries to bypass script signing requirements, allowing the execution of unsigned or malicious PowerShell scripts.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.
Detects obfuscated PowerShell code being executed via standard input (stdin) within PowerShell module logs. This technique is often used by adversaries to evade detection by security products that monitor for suspicious commands or scripts.
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
Detects highly obfuscated PowerShell commands using the VAR++ LAUNCHER technique, often associated with Invoke-Obfuscation. This method involves using `&&set` and specific character patterns like `(\{\d\}){2,}\"` combined with `-f` and `cmd /c` to evade detection.
This rule detects potential data exfiltration attempts using PowerShell by identifying scripts that manipulate binary data into audio file formats, specifically WAV. It looks for PowerShell script block text containing mathematical operations, file I/O mode definitions, and the use of BinaryWriter, combined with specific byte sequences indicative of a WAV file header. This technique can be used to encode arbitrary data into an audio file for covert exfiltration.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
Page 208 of 213