Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of potentially malicious utilities (curl, finger, cmd, powershell) that are launched by the Windows Explorer process (explorer.exe). This pattern is often indicative of malicious activity where an adversary uses legitimate OS processes to spawn command shells or network tools for further exploitation or file retrieval.
Detects the loading of 'clr.dll' and 'System.Management.Automation.dll' (or related variants) by a process that is not a known PowerShell host. This behavior is indicative of a 'PSInline' execution technique, where an attacker leverages COM or direct assembly loading to execute PowerShell scripts or commands within a benign or malicious process to avoid spawning explicit powershell.exe processes.
Detects instances where PowerShell is executed with an explorer.exe parent process, but the actual creating process differs from explorer.exe. This behavior is indicative of parent PID (PPID) spoofing, a technique often used to evade detection or masquerade the execution source by abusing the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS flag in the Windows API.
This rule detects potentially unauthorized or suspicious repository interactions by monitoring 'git' commands executed by common AI-assisted coding tools or command-line developer utilities. It flags occurrences where a checkout operation occurs without accompanying standard git history or status checks, which may indicate automated exfiltration or lateral movement attempt within a developer environment.
Detects execution of PowerShell or Command Prompt where the command line contains obfuscated indicators or specific suspicious files and IP addresses, while simultaneously bypassing the execution policy. This is characteristic of malicious script execution or payload delivery attempts.
Detects execution of PowerShell or CMD commands originating from Windows Explorer (explorer.exe) that exhibit characteristics of malicious command-line obfuscation, such as encoded commands, bypass flags, or caret-based character obfuscation.
Detects the use of .NET reflection and assembly loading techniques within PowerShell or C# compiler (csc.exe) command lines. Attackers frequently use these methods to load malicious payloads directly into memory, bypassing disk-based detection mechanisms. The rule looks for the combination of reflection-related namespaces/methods and indicators of obfuscation or encoding such as Base64 strings, Gzip compression, and decryption routines.
Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.
Detects execution of PowerShell spawned by wscript.exe or cscript.exe attempting to retrieve a process-level environment variable named 'Kv[0-9]+'. This pattern is associated with 'LausivLoader', which uses environment variables to pass file paths or malicious payloads between a legacy script host and PowerShell. The rule optionally tracks attempts to delete associated files after the handoff.
Detects the spawning of a hidden PowerShell process by wscript.exe via conhost.exe with the --headless argument. This pattern is characteristic of the LausivLoader malware, which utilizes obfuscated command-line arguments to execute hidden PowerShell scripts.
Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.
Detects execution of PowerShell commands containing indicators of in-memory AMSI (Antimalware Scan Interface) patching, specifically referencing AmsiScanBuffer, AmsiScanString, or AmsiOpenSession in conjunction with amsi.dll. This behavior is associated with the initialization stage of LausivLoader prior to its payload retrieval phase.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects the use of PowerShell command lines containing both 'AesManaged' for decryption and '[System.Reflection.Assembly]::Load' for reflective loading of a .NET assembly in memory. This pattern is consistent with the execution stage of malware such as LausivLoader, which stage encrypted payloads and load them directly into the process memory to evade disk-based detection.
Detects a suspicious execution chain where WScript.exe initiates a process with '--headless' arguments, which in turn spawns a PowerShell process with hidden, encoded, and non-interactive command line flags. This pattern is commonly used by adversaries to execute malicious scripts while attempting to evade detection and user interaction.
This rule detects PowerShell script blocks that exhibit multiple indicators of obfuscation and in-memory execution. It identifies the combination of AES encryption, embedded key bytes commonly associated with deobfuscation routines, GZip compression, and reflective assembly loading (Assembly.Load). The use of multiple techniques simultaneously significantly increases the likelihood of malicious activity, such as fileless malware loading or execution of obfuscated payloads.
Detects attempts to modify Windows Defender security settings by adding exclusions to the scan path using various PowerShell cmdlets or WMI methods. This behavior is often associated with adversaries attempting to evade detection by excluding malicious tools or directories from antivirus scanning.
This rule detects unauthorized memory modification of ntdll.dll, specifically targeting the EtwEventWrite function, by identifying processes writing to memory regions with execution-permission flags (e.g., PAGE_EXECUTE_READWRITE). This behavior is characteristic of adversaries attempting to blind Event Tracing for Windows (ETW) telemetry, often following suspicious .NET assembly loading (such as Assembly.Load) typical of malware loaders like LausivLoader.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Page 33 of 213