Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference specific task names associated with potentially suspicious activity or persistence (e.g., PlutonAgentScheduler, EnterpriseMgmtServicesScheduler). The rule specifically looks for tasks being placed or modified within 'microsoft' or 'pluton' directories or paths, which may indicate an attempt to masquerade as legitimate system services.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference specific task names associated with potentially suspicious activity or persistence (e.g., PlutonAgentScheduler, EnterpriseMgmtServicesScheduler). The rule specifically looks for tasks being placed or modified within 'microsoft' or 'pluton' directories or paths, which may indicate an attempt to masquerade as legitimate system services.
Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.
Detects the launch of client32.exe (a core component of NetSupport Manager) as a child process of PowerShell, indicating potential malicious deployment of the software as a RAT rather than legitimate administrative activity.
Detects the initiation of PowerShell by the Windows Explorer process (explorer.exe), which is often indicative of malicious activity such as lateral movement or execution of scripts originating from user-triggered actions. The rule flags command lines containing obfuscated patterns, bypass arguments, or encoded commands.
Detects the execution of PowerShell from a shortcut (.lnk) file, particularly when suspicious command-line arguments such as hidden windows, encoded commands, or bypass flags are utilized. This pattern is commonly associated with initial access via malicious attachments or shortcut files.
Detects the execution of PowerShell commands that utilize .NET cryptography classes (AesManaged) in conjunction with data compression (GZipStream) and base64 decoding (FromBase64String). This combination of classes is highly characteristic of malicious scripts designed to decrypt and execute obfuscated or packed payloads in memory.
Detects the use of PowerShell commands (Get-Volume, Get-Partition, Get-Disk) to identify and inspect information about connected removable storage media such as USB, IEEE 1394, SD, or MMC devices. This behavior is indicative of an adversary enumerating potential targets for data staging or exfiltration.
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the use of PowerShell script interpreters that utilize .NET runtime methods, such as 'RunspaceFactory' and 'CreateRunspace', to dynamically create and execute scripts, pipelines, or invoke methods. This technique is often used by fileless malware and offensive security tools to bypass traditional command-line logging by interacting directly with the System.Management.Automation assembly.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to modify the 'amsiInitFailed' field within the 'AmsiUtils' class. This technique is commonly used by malicious scripts to disable AMSI scanning during their execution.
Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.
Detects the execution of PowerShell with execution policy bypass flags that simultaneously attempts to use curl.exe and Copy-Item to interact with suspicious remote domains or obfuscated command line arguments, potentially indicating a malicious payload delivery and staging attempt.
Detects suspicious PowerShell command lines indicative of process termination or abnormal enumeration of .NET Framework process directories via WMI. This includes using Stop-Process against specific proxy execution binaries or using Get-CimInstance to inspect sensitive .NET framework directory structures, which may be associated with process hollowing or security product interference.
Detects the execution of PowerShell scripts that use Invoke-Expression and Invoke-RestMethod in combination with specific suspicious domains, file extensions, or indicators of web-based payload retrieval. This pattern is commonly used for staging and executing malicious payloads directly from the internet.
Detects PowerShell instances executing 'Stop-Process' against known living-off-the-land binaries (LotLBin) or PowerShell processes explicitly terminating these specific binaries. This behavior is often associated with process hollowing, anti-forensics, or attempts to clear space for malicious code injection by terminating security or system-related tools.
This rule detects instances where PowerShell is launched with hidden window arguments by explorer.exe or mshta.exe, and the command line indicates interactions with specific file extensions (.vbs, .ps1) located within the AppData directory. This pattern is often indicative of malicious script execution, such as those used in Konni malware campaigns to drop and execute payloads.
Detects execution of PowerShell commands indicative of the VelvetCake variant of the Konni malware. The rule identifies the use of 'Net.WebClient.DownloadString' combined with 'Invoke-Expression' (iex) to execute scripts in memory, alongside specific command-line indicators such as the 'Areyou=cake' campaign marker or associated C2 domains.
Detects the execution of PowerShell commands that leverage specific tooling for scheduled task enumeration, commonly used for discovery or persistence management. The rule flags usage of 'Get-AccessibleScheduledTask' in conjunction with flags associated with tools like NtObjectManager or OleViewDotNet.
Page 13 of 91