Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
12
5
1
1
Contributors
9
3
3
3
1
Categories
8
6
5
5
4
Platforms
19
1
1
1
Products / Services
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
This rule detects PowerShell execution that includes specific command-line arguments consistent with decoding XOR-encoded payloads. It looks for 'powershell.exe' processes where the command line contains '-bxor' and references to files like 'Profile.ps1', '1.dat', or 'Com.dat', which are associated with the Dragon Weave campaign's decoding activities.
Detects malicious code written to PowerShell profile scripts
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
Detects malicious code written to PowerShell profile scripts
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
This rule detects the creation or modification of a PowerShell profile specifically for Visual Studio Code (VSCode). Adversaries may modify these profiles to establish persistence or escalate privileges by injecting malicious commands or scripts that execute every time a user opens a VSCode PowerShell session. This technique can be used to run arbitrary code without direct user interaction after the initial compromise.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.
Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence