Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects a correlation between host-level reconnaissance activity using WMI (via PowerShell or WMIC) to query system information, followed by network exfiltration to a known C2 IP address over a specific URI within a 10-minute window.
Detects the execution of PowerShell via WScript or CScript where the command line contains instructions to remove an environment variable. This pattern is commonly used by adversaries to clear sensitive environment data or bypass certain application restrictions.
Detects command-line activity indicating an attempt to bypass or tamper with Anti-Malware Scan Interface (AMSI) functionality. The rule flags processes invoking GetProcAddress or LoadLibrary to resolve and manipulate AMSI-specific functions like AmsiScanBuffer or AmsiScanString within amsi.dll, a common technique for disabling runtime script scanning.
Detects the use of .NET reflection methods such as Assembly.Load or EntryPoint.Invoke within PowerShell command lines. This behavior is frequently used by attackers to reflectively load malicious .NET assemblies or shellcode directly into process memory, bypassing disk-based detection.
Detects execution of PowerShell commands containing indicators of in-memory AMSI (Antimalware Scan Interface) patching, specifically referencing AmsiScanBuffer, AmsiScanString, or AmsiOpenSession in conjunction with amsi.dll. This behavior is associated with the initialization stage of LausivLoader prior to its payload retrieval phase.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects the use of PowerShell command lines containing both 'AesManaged' for decryption and '[System.Reflection.Assembly]::Load' for reflective loading of a .NET assembly in memory. This pattern is consistent with the execution stage of malware such as LausivLoader, which stage encrypted payloads and load them directly into the process memory to evade disk-based detection.
Detects the execution of PowerShell scripts that utilize a multi-stage deobfuscation and loading technique. The script decrypts a staged payload using AesManaged (with specific hardcoded byte constants), decompresses the result via GZipStream, and uses [System.Reflection.Assembly]::Load to reflectively execute the resulting .NET assembly in memory. This pattern is characteristic of advanced malware loader chains, such as those used by the 'LausivLoader'.
Detects a suspicious execution chain where WScript.exe initiates a process with '--headless' arguments, which in turn spawns a PowerShell process with hidden, encoded, and non-interactive command line flags. This pattern is commonly used by adversaries to execute malicious scripts while attempting to evade detection and user interaction.
This rule detects PowerShell script blocks that exhibit multiple indicators of obfuscation and in-memory execution. It identifies the combination of AES encryption, embedded key bytes commonly associated with deobfuscation routines, GZip compression, and reflective assembly loading (Assembly.Load). The use of multiple techniques simultaneously significantly increases the likelihood of malicious activity, such as fileless malware loading or execution of obfuscated payloads.
Detects attempts to modify Windows Defender security settings by adding exclusions to the scan path using various PowerShell cmdlets or WMI methods. This behavior is often associated with adversaries attempting to evade detection by excluding malicious tools or directories from antivirus scanning.
Detects attempts to disable Windows Defender Tamper Protection via direct Registry modification or by executing PowerShell commands. Disabling Tamper Protection is a common tactic used by adversaries to facilitate further malicious activity, such as impairing security controls or deleting malware artifacts without interference from Windows Defender.
This rule detects multiple distinct methods of modifying, impairing, or disabling Microsoft Defender Antivirus exclusions and tamper protection settings. It identifies suspicious activity through PowerShell commands (Add-MpPreference, Set-MpPreference, Invoke-CimMethod, TamperProtection modification), direct registry modification of Defender exclusion paths, and the use of scheduled tasks to maintain or enforce these changes. The rule flags endpoints where two or more of these distinct techniques are observed in a 24-hour period.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
Detects the use of PowerShell cmdlets and parameters to perform system, hardware, and external drive discovery. This includes querying volume information, disk/partition details, and checking for removable or specific bus-type media (USB, SD, MMC), which is commonly associated with reconnaissance activities by an adversary.
Detects the use of PowerShell to enumerate storage devices (USB, disk, partition information) and perform file operations such as copying or logging, potentially indicating malicious data collection from removable media or external drives.
Detects the execution of PowerShell with encoded commands in headless mode, associated with the Microsoft Edge Update Task (MicrosoftEdgeUpdateTaskUserS-1-5-24). This pattern is indicative of potential malicious activity where legitimate update tasks are abused to run obfuscated scripts.
This rule detects the use of PowerShell to download a specific payload associated with the RustyShade malware from a Backblaze B2 cloud storage bucket. It monitors command lines containing 'wget' or 'Invoke-WebRequest' targeting 'f005.backblazeb2.com' and files named 'DriverInstaller.zip'.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Page 15 of 91