Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
113
59
26
14
14
Contributors
78
29
27
23
19
Categories
169
136
66
57
39
Platforms
206
22
19
9
2
Products / Services
96
53
31
25
11
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.
Detects potential command-line obfuscation techniques using escape characters, specifically looking for 'h^t^t^p' or 'h"t"t"p' patterns in process command lines. This method is often used by adversaries to evade detection by security tools that might be looking for cleartext indicators like URLs.
Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Page 13 of 13