Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
This rule detects PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by using .NET reflection techniques. The detection monitors for common class and method names (e.g., 'AmsiUtils', 'Marshal.WriteInt64') utilized by attackers to disable or tamper with AMSI's memory structures within a running PowerShell process.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) using .NET reflection techniques. It specifically looks for patterns involving the manipulation of internal AMSI fields, such as 'AmsiUtils', 's_amsiInitFailed', and 'DynamicMethod', which are common indicators of malicious attempts to disable or evade script content analysis in memory.
Detects the execution of PowerShell processes where command lines contain references to Nishang framework scripts, 'Invoke-PowerShellTcp' reverse shell patterns, or indicators of attempts to bypass the Antimalware Scan Interface (AMSI) such as 'AmsiScanBuffer' or 'amsiInitFailed'.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common reflection-based patterns, such as accessing 'AmsiUtils', modifying 'amsiInitFailed' flags, or using 'BindingFlags' to manipulate non-public members. These techniques are commonly used to disable AMSI scanning within a malicious PowerShell script's memory space.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
Detects files retaining the MOTW (Zone.Identifier) executing successfully because their Fox Tempest signature bypasses SmartScreen warnings.
This rule detects PowerShell script block execution containing indicators commonly associated with JIT heap memory manipulation and AMSI bypass techniques. It uses a scoring system based on the presence of specific .NET classes and methods used to allocate, copy, and change protection on memory pages, which are typical of fileless payload execution and security feature subversion.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Detects PowerShell scripts attempting to tamper with or bypass the Antimalware Scan Interface (AMSI) by reflecting on the 'AmsiUtils' class within the 'System.Management.Automation' assembly. This activity is a common technique used by adversaries to execute malicious scripts without security product intervention.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects the use of System.Reflection.Emit.DynamicMethod in PowerShell to dynamically compile and execute Intermediate Language (IL) code. This technique is commonly used to patch AMSI internals, specifically by modifying 's_amsiInitFailed' to bypass scanning capabilities.
Detects mshta.exe launching HTA files with randomized query strings that instruct the server-side to generate a unique payload hash, indicative of the ClickFix malware.
Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.
Detects IMAP, POP, SMTP AUTH, or other legacy authentication activity soon after the same account completes modern MFA. This could indicate an adversary bypassing MFA by using legacy protocols after successfully authenticating with modern MFA.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects sophisticated AMSI bypass attempts in PowerShell sessions. The rule monitors for a combination of techniques, including patching the 'InternalNotify' function in the AMSI vtable using 'VirtualProtect', and leveraging 'Marshal.WriteInt64' to nullify critical security scan paths ('WinScanContent' and 'WinReportContent') in memory.
Page 379 of 864