Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects the execution of PowerShell scripts associated with the WLDR Agent, specifically looking for indicators of RunspacePool initialization, module runspace starts, and message queue communication patterns.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects the creation of a scheduled task via PowerShell using 'Register-ScheduledTask' configured to run as the SYSTEM account at system startup. The detection specifically identifies tasks with dynamically generated hexadecimal names (8-20 characters), a technique associated with the persistence mechanism of Banana RAT.
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects the use of PowerShell to execute WMI queries against the Win32_ComputerSystem class to identify domain membership information. This is a common discovery technique used by attackers to profile the environment and understand network context.
Detects unauthorized attempts to perform bulk enumeration of Active Directory user objects by monitoring for Get-ADUser cmdlet execution with wildcard filters. Additionally, it monitors for the creation of common output files (e.g., CSV exports) often used to store the results of such reconnaissance activities.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.
Detects the use of the Get-ADReplicationSubnet PowerShell cmdlet to query Active Directory replication subnet configurations. Attackers may use this command to map the internal network topology, identify domain controllers, and scope lateral movement targets within the AD environment.
Detects attempts to discover domain controllers using various fallback techniques including nltest, PowerShell cmdlets (Get-ADDomainController), and querying the LOGONSERVER environment variable. Attackers use these methods to map network infrastructure and identify domain controllers for lateral movement or domain enumeration.
Page 34 of 91