Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.
Detects PowerShell command lines that fetch a remote module using methods like DownloadString or Invoke-WebRequest, subsequently executing the downloaded code in-memory via Invoke-Expression (iex), and finally invoking a main() function. This pattern matches the execution chain used by the CountLoader malware (taskType 5).
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Detects non-standard processes, particularly fileless PowerShell, accessing Windows Token Broker cache (.tbres) files, a technique associated with ChocoShell credential/token theft.
This rule detects PowerShell processes attempting to bypass the Antimalware Scan Interface (AMSI) via .NET reflection, specifically targeting 'AmsiUtils' or 'amsiInitFailed' fields. To reduce noise, it correlates this activity with the presence of WinHTTP COM objects (for network evasion) or timing-based functions (e.g., Stopwatch, GetTickCount) often used for anti-sandbox or anti-analysis evasion, characterizing behavior consistent with the ChocoShell malware family.
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
This rule detects malicious activity associated with the DOUBLECUP/CountLoader malware by correlating specific PowerShell execution patterns within a single process lineage. It flags process sequences where an encoded PowerShell command (using -enc or -encodedcommand) occurs in conjunction with suspicious .NET reflection (System.Reflection.Assembly) or ScriptBlock invocation within a 5-minute window. The rule explicitly excludes processes with valid digital signatures to reduce false positives from legitimate administrative software.
Detects PowerShell processes whose command line chains a main() function call directly into Invoke-Expression, consistent with CountLoader's module-fetch-and-execute pattern used by DOUBLECUP LaaS.
Detects PowerShell processes launched with encoded command arguments (-enc/-EncodedCommand) alongside reflective .NET assembly loading or ScriptBlock usage from the same process lineage within a 5-minute window, indicative of CountLoader-style in-memory payload execution.
Detects PowerShell invoking Get-CimInstance against Win32_Process to enumerate running processes (ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine), converting output to compressed JSON, when spawned by or related to python.exe or cmd.exe -- consistent with the Edgecution native host's process-enumeration command (command 6).
Detects malicious PowerShell activity attempting to bypass the Antimalware Scan Interface (AMSI) by identifying command-line patterns associated with 'CountLoader' and similar malware. It targets the use of .NET reflection to manipulate AmsiUtils fields and the use of dynamic function resolution (D/Invoke) techniques via GetDelegateForFunctionPointer and GetProcAddress to evade static detection.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
Detects PowerShell or pwsh execution containing a custom regex-based JSON key/value parsing pattern (mimicking CountLoader's manual JSON parsing) in either the raw command line or a base64-decoded encoded command, while excluding legitimate ConvertFrom-Json usage.
Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.
Page 30 of 91