Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
MMC Spawning Windows Shell
Cortex XDR
Detects instances where the Microsoft Management Console (mmc.exe) launches suspicious child processes often associated with adversary activity, such as command shells, scripting engines, or system management utilities. This behavior is frequently used to proxy execution or perform unauthorized system modifications, with the exception of the standard Task Scheduler snap-in.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects anomalous, high-frequency usage of Active Directory PowerShell cmdlets (e.g., Get-ADUser, Get-ADGroup) by a single user or process within a short timeframe, which is a common indicator of internal domain reconnaissance by an adversary.
Detects the execution of known Active Directory enumeration scripts or commands via PowerShell shortly after a Remote Desktop (RDP) login session is established on a device. This pattern is indicative of an attacker who has gained remote access and is immediately performing discovery activities.
Detects the execution of known offensive PowerShell scripts used for Active Directory information gathering, as identified by specific file names or internal script block strings.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Detects PowerShell scripts containing logic indicative of extracting payloads hidden via steganography (e.g., LSB or channel-based extraction from pixel data) combined with memory-based decryption. This behavior is commonly associated with stealthy malware loaders attempting to reconstruct malicious code from image files.
Detects the use of the C# compiler (csc.exe) to compile code that references the 'System.Management.Automation' assembly. This pattern is commonly used in 'PS2EXE' techniques or custom loaders to execute PowerShell functionality from within a compiled binary, often to evade security controls that monitor for direct powershell.exe usage.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Page 73 of 213