Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects powershell scripts that import modules from suspicious directories
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.
Detects a suspicious or uncommon parent processes of PowerShell
Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder
Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques
Detects events that appear when a user click on a link file with a powershell command in it
Detects possible execution via LNK file accessed on a WebDAV server.
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
Detects the PowerShell command lines with special characters
Yara rule that detects LimeRAT backdoor.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.
Detects various execution patterns of the CrackMapExec pentesting framework
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects command line parameters used by Bloodhound and Sharphound hack tools
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Page 212 of 213