Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell with a combination of flags commonly used to bypass security policies, obscure command execution, and run hidden tasks: -NoProfile, -ExecutionPolicy Bypass, and -EncodedCommand.
Detects the execution of PowerShell with a combination of flags commonly used by attackers to hide activity, bypass execution policies, and execute encoded or scripted commands. This pattern often indicates attempts to run malicious scripts stealthily on a Windows host.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects the execution of PowerShell via explorer.exe using hidden windows styles and encoded commands. This behavior is often associated with fileless execution, initial access via malicious attachments or documents, and various obfuscation techniques used by adversaries to evade detection.
Detects the execution of the PowerShell script 'install_ad.ps1' with the '-ExecutionPolicy Bypass' flag. This pattern is commonly associated with automated software deployment scripts, such as AnyDesk, and may be used by adversaries to facilitate malicious script execution while evading security policies.
Detects multiple occurrences of processes initiating with a hidden window (SW_HIDE) flag within a short timeframe on the same device. This behavior is often associated with obfuscated script execution, persistence mechanisms, or malicious tools attempting to remain stealthy during execution.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window styles, and suspicious cmdlets like IEX or WebClient) when launched from explorer.exe. This pattern is commonly associated with fileless malware execution or malicious script downloads.
Detects Microsoft Defender service (MsMpEng.exe) spawning common interactive or scripting processes (such as cmd.exe, powershell.exe, etc.) while running as SYSTEM. This behavior is highly irregular for an antivirus engine and is characteristic of exploit-based process hollowing or quarantine pipeline abuse, as observed in CVE-2026-50656.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the execution of PowerShell with specific flags to bypass execution policy and hide the window, commonly used to execute encoded payloads. This rule monitors for PowerShell processes spawned by suspicious parent processes such as 'cmd.exe' or 'ElevatorShellCode.exe' that include parameters like '-ep bypass', '-w hidden', and base64-encoded strings.
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by invoking memory manipulation techniques. The rule monitors for the usage of 'VirtualProtect', 'GetProcAddress', and 'LoadLibrary' in combination with AMSI-specific strings (e.g., 'AmsiScanBuffer', 'amsi.dll') and the .NET 'Runtime.InteropServices.Marshal' namespace, which are indicative of an in-memory AMSI patch or obfuscation.
Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects suspicious PowerShell execution patterns involving dynamic command reconstruction using [char[]] character arrays and the iex (Invoke-Expression) cmdlet, or the use of specific base64 EncodedCommand prefixes associated with known obfuscation tools like Banana RAT.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects anomalous process execution chains where Fortinet FortiClient scheduler processes (scheduler.exe or FortiTray.exe) spawn cmd.exe to execute command scripts, or subsequently spawn PowerShell with obfuscated command line arguments (-enc, -EncodedCommand) and hidden window flags (-w 1), as identified in the FortiBleed campaign.
Page 75 of 213