Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell with the encoded command parameter (-encodedcommand or -enc), followed by a substantial base64-encoded string. This is a common technique used by attackers to obfuscate malicious PowerShell scripts, bypass signature-based detection, and execute payloads in memory.
Detects instances where common productivity (e.g., Office) or web browser applications spawn PowerShell.exe with suspicious command-line arguments often associated with malicious script execution or obfuscated code downloaders, such as '-w hidden', '-nop', or '-enc'.
Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.
Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.
Detects the execution of PowerShell with flags commonly used to obfuscate command lines or hide activity from the user, such as -EncodedCommand or -WindowStyle Hidden. These techniques are frequently used by adversaries to execute malicious scripts while avoiding detection.
Detects instances where PowerShell is executed via the Windows Run dialog (explorer.exe), utilizing common download-cradle patterns (IEX/Invoke-Expression and Invoke-RestMethod) typically associated with ClickFix clipboard-hijacking social engineering campaigns.
Detects the PowerShell command lines with special characters
Detects instances where common scripting or package management tools (e.g., node.exe, python.exe, pip.exe, npm.exe) launch Windows command line interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) with command-line arguments indicative of potentially malicious activity, such as base64-encoded strings, command execution flags, or high-entropy command lines.
This rule monitors for instances where powershell.exe is spawned by cmd.exe, which in turn is a child process of the RemoteMouse application. It specifically flags command lines that involve network socket initialization or encoded commands, both of which are common indicators of malicious activity such as reverse shells or script-based attacks originating from a possibly compromised or malicious binary.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Detects execution of PowerShell with encoded commands ('-enc') and window style hidden ('-w 1') initiated by processes associated with Fortinet FortiClient (e.g., scheduler.exe, fortitray.exe), or matching known encoded command patterns. This often indicates the use of legitimate management processes to execute obfuscated malicious scripts.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects the execution of PowerShell with security-bypassing flags (-ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden) launched by the Windows Script Host (wscript.exe). This pattern is associated with the VEIL#DROP campaign where JavaScript lures invoke PowerShell to bypass AMSI and security controls.
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
Detects the use of PowerShell to forcefully terminate 'wscript.exe' using 'Stop-Process' or 'taskkill'. This behavior is associated with adversaries, such as those in the VEIL#DROP campaign, attempting to minimize forensic evidence after executing malicious JavaScript lures via Windows Script Host.
The analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) execution by using Get-Variable to parse out IEX characters from the MaximumDriveCount built-in variable and reconstruct them via -Join.
This rule detects processes that rapidly create and unload .NET application domains within a 60-second window. This behavior is often associated with .NET-based in-memory code execution, where attackers use AppDomains to isolate, execute, and quickly dispose of malicious payloads to avoid detection.
Detects the creation of specific shortcut files (.lnk) or the use of WScript.Shell and CreateShortcut methods within PowerShell, associated with the VILE ransomware's fake decryptor lure technique.
Page 77 of 213