Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,660
9,755
6,689
4,418
3,748
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects usage of PowerShell cmdlets to disable or remove Event Tracing for Windows (ETW) trace sessions. This activity can be an attempt by an adversary to impair defenses by blocking or removing indicators that would normally be collected by security monitoring tools.
This rule detects command-line executions that include specific function calls, 'LoadAssemblyFromPath' or 'LoadAssemblyFromNS', which are associated with the 'CL_LoadAssembly.ps1' script. This script can be leveraged to load .NET assemblies, potentially bypassing AppLocker controls and executing arbitrary code. The detection focuses on instances where these function calls are made directly via command-line arguments, such as through PowerShell's '-Command' or '-ScriptBlock' flags.
This rule detects attempts to enumerate Active Directory groups and user properties using specific PowerShell cmdlets. It looks for the use of 'get-ADPrincipalGroupMembership' to identify group memberships and 'get-aduser' with specific parameters ('-f', '-pr', 'DoesNotRequirePreAuth') which can be used to discover user attributes relevant for privilege escalation or further reconnaissance. This activity is often performed by adversaries to map out the domain environment and identify accounts with elevated privileges.
This rule detects attempts to clear PowerShell command history, which adversaries might do to remove traces of their activities. It looks for specific PowerShell commands and keywords related to deleting history files or configuring PowerShell to not save history. This includes commands like 'del', 'Remove-Item', 'rm' in conjunction with the PowerShell history path, or setting 'Set-PSReadlineOption -HistorySaveStyle SaveNothing'.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects the use of the PowerShell cmdlet "Enable-WindowsOptionalFeature" to enable potentially suspicious or insecure Windows features. This cmdlet functions similarly to DISM.exe for managing Windows features and packages. The rule specifically looks for the enablement of features like Telnet Server, Internet Explorer (optional), TFTP, SMB1 Protocol, Client-ProjFS, and Windows Subsystem for Linux, which might be enabled by adversaries for various purposes or represent a security risk if not intentionally used.
Detects the execution of the 'Get-Clipboard' PowerShell cmdlet via the command line interface. This cmdlet is used to retrieve the current content of the clipboard, which could be leveraged by adversaries for data collection.
Detects the use of the "Set-Service" PowerShell cmdlet to modify a service's Security Descriptor Definition Language (SDDL) to hide the service from standard enumeration utilities like "sc.exe" or "Get-Service". This technique leverages specific SDDL flags (DCLCWPDTSD) to restrict access and visibility, primarily effective in PowerShell 7 environments.
Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in potentially suspicious locations often used by malware for exfiltration. This activity indicates an adversary might be compressing collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network data transfer.
This rule detects the execution of the PowerShell cmdlet 'Get-NetTCPConnection', which adversaries may use to discover network connections on a compromised system. This activity is often part of the discovery phase in an attack chain, where an attacker gathers information about the network environment.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects code execution where PowerShell (powershell.exe or pwsh.exe) is the parent process and its command line contains references to the Pester module, specifically when Pester is used to invoke other commands or scripts. This could indicate an adversary leveraging Pester for execution, potentially for defense evasion or to bypass security controls.
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
Detects suspicious PowerShell commands that utilize the Net.WebClient object to download files or strings from the internet. This is a common technique used by adversaries for ingress tool transfer or to execute malicious code.
Page 23 of 24