Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects PowerShell script blocks containing a suspicious combination of Base64-like character sets and Cyrillic characters. This technique is often used in obfuscated payloads to evade static analysis signatures or to hinder human readability by inserting non-Latin characters within encoded content, which may trigger different parsing behaviors in various environments.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
Detects the creation of a 'SystemIn.lnk' persistence shortcut on Windows systems using PowerShell and the WScript.Shell COM object. This activity is associated with the QUICAgent backdoor, part of the QUICSILVER operation, which uses temporary PowerShell scripts to establish persistence.
Detects the use of PowerShell to remove the 'Zone.Identifier' NTFS Alternate Data Stream (ADS) from files. This stream is responsible for the 'Mark-of-the-Web' (MOTW) which triggers security warnings in Windows, including SmartScreen and Protected View. Adversaries use this technique to evade security controls on downloaded malicious files.
Detects malicious PowerShell command chains often used in ClickFix campaigns. These commands typically move zip files from the user's Downloads directory to a temporary folder, extract them using the tar utility, and execute an embedded PowerShell script using conhost in headless mode. This technique is designed to bypass AMSI command-line inspection by offloading the actual payload execution to an extracted, unmonitored script.
Detects attempts to impair or disable Microsoft Defender Antivirus through unauthorized exclusion paths, Registry modifications, tampering with protection settings, or forcing policy updates.
Detects execution of PowerShell processes employing common obfuscation and evasion techniques frequently associated with fileless malware loaders and malicious script execution. This includes the use of EncodedCommand, Base64 strings, IEX/Invoke-Expression download cradles, and stealth execution flags (e.g., hidden windows combined with non-interactive modes).
Detects suspicious PowerShell execution patterns involving encoded commands, hidden window styles, or common download cradles combined with code obfuscation techniques. This rule monitors PowerShell ScriptBlock Logging (Event ID 4104) for combinations of indicators often used by threat actors to evade detection, such as Base64-encoded strings, hidden execution flags, network download utilities, and script obfuscation techniques.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
Detects execution patterns indicative of 'ClickFix' social engineering, where a user is tricked into copying a command to their clipboard and executing it directly in a terminal. The rule monitors for processes that read clipboard contents (via PowerShell or clip.exe) and simultaneously invoke shell interpreters to execute the retrieved data.
Detects mshta.exe initiating outbound network connections, followed closely by the execution of a powershell.exe process with an unusually large command line, or PowerShell script block events containing large, potentially obfuscated scripts. This behavior is indicative of 'DeepLoad' or 'ClickFix' style staging, where legitimate binaries are leveraged to download and execute heavily obfuscated payloads.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects the use of PowerShell to modify Windows Defender exclusions by adding a path or process located in user-controlled directories (Downloads, Temp, AppData). This behavior is characteristic of adversaries attempting to suppress security alerts for malicious binaries masquerading as legitimate software.
Detects the use of PowerShell to perform COM database enumeration, often associated with OleViewDotNet or NtObjectManager tools, specifically looking for indicators of COM object querying such as InProcServer32 path identification.
Detects instances of PowerShell being launched directly by Windows Explorer (explorer.exe), which is indicative of a user interacting with the 'Run' dialog (Win+R). The rule specifically flags common ClickFix social-engineering patterns, such as hidden windows and the use of download/execution cmdlets (e.g., Invoke-WebRequest, Invoke-RestMethod) used to fetch and run remote payloads.
Page 11 of 91