Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986
Detects the execution of PowerShell with typical reverse shell command-line flags (-nop, -w hidden, -c) launched as a child process of cmd.exe. This pattern is commonly associated with remote code execution (RCE) scenarios, such as the exploitation of vulnerable applications that inject keystrokes or system commands via unauthenticated interfaces.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Detects the execution of PowerShell commands that attempt to open or process a specific suspicious PDF file named 'Rate_Confirmation_LD-2026-0847.pdf' located in user download directories. This pattern is often indicative of social engineering attempts where a user is tricked into opening a malicious file.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.
This rule detects a suspicious process execution chain where the FortiClient scheduler (scheduler.exe) initiates a command-line interpreter (cmd.exe) to execute a batch file, which subsequently launches a PowerShell process with obfuscated or hidden command-line arguments (e.g., -w 1, -enc). This chain is often indicative of post-exploitation activity, specifically related to the FortiBleed vulnerability chain or the deployment of infostealers.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
Detects suspicious PowerShell execution patterns characterized by the 'ClickFix' social engineering technique. This involves an attacker tricking a user into copying and pasting a PowerShell command into their terminal, often disguised as a fake reCAPTCHA or security verification page. The rule monitors for PowerShell processes spawned by common user-facing applications (explorer.exe, conhost.exe, WindowsTerminal.exe) that contain specific command-line arguments like 'iex(irm' or 'iex(iwr'.
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Detects instances where Windows Explorer (explorer.exe) spawns common command-line interpreters (powershell.exe, mshta.exe, cmd.exe) with suspicious command-line arguments indicative of fileless execution, obfuscation, or remote payload retrieval.
Detects the use of a common PowerShell download cradle (Invoke-Expression with Invoke-RestMethod) targeting a direct IP address. This pattern is frequently observed in 'ClickFix' style attacks where users are tricked into copying and pasting malicious commands into their terminal, which then pull secondary payloads from adversary-controlled infrastructure.
Detects anomalous PowerShell activity associated with the EKZ Stealer, characterized by a multi-stage chain involving file download, hidden process execution, temporary file staging, base64 encoding, and exfiltration via HTTP POST requests, followed by cleanup of logs.
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Detects the execution of PowerShell with a hidden window (-w 1) and base64 encoded arguments containing a specific string (JABVAHIAbAA). This combination is commonly used by malicious scripts or fileless malware loaders to execute obfuscated code silently.
Page 76 of 213