Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the PowerShell script 'install_ad.ps1' with the '-ExecutionPolicy Bypass' flag. This pattern is commonly associated with automated software deployment scripts, such as AnyDesk, and may be used by adversaries to facilitate malicious script execution while evading security policies.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the PureLog Stealer performing system and process reconnaissance using .NET capabilities reflectively loaded via PowerShell. The rule monitors for the combination of process enumeration (System.Diagnostics.Process/Win32_Process), system metadata harvesting (Environment class properties), and memory-only execution patterns (Reflection.Assembly.Load) within PowerShell script block logs.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects suspicious PowerShell execution patterns involving dynamic command reconstruction using [char[]] character arrays and the iex (Invoke-Expression) cmdlet, or the use of specific base64 EncodedCommand prefixes associated with known obfuscation tools like Banana RAT.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects the use of PowerShell Get-ADComputer cmdlet with wildcard filters combined with parameters like -Server or -Properties, or redirects to CSV files. This pattern is indicative of unauthorized discovery of domain computer objects.
Detects adversary cleanup activities where PowerShell is used to remove script files and shortcuts (.lnk, .js, .bat, .vbs) from common persistence and startup directories (APPDATA, PUBLIC, ProgramData, and Startup folder), often associated with Veil#Drop anti-forensic techniques.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.
Detects suspicious PowerShell execution patterns characterized by the 'ClickFix' social engineering technique. This involves an attacker tricking a user into copying and pasting a PowerShell command into their terminal, often disguised as a fake reCAPTCHA or security verification page. The rule monitors for PowerShell processes spawned by common user-facing applications (explorer.exe, conhost.exe, WindowsTerminal.exe) that contain specific command-line arguments like 'iex(irm' or 'iex(iwr'.
Detects the use of a common PowerShell download cradle (Invoke-Expression with Invoke-RestMethod) targeting a direct IP address. This pattern is frequently observed in 'ClickFix' style attacks where users are tricked into copying and pasting malicious commands into their terminal, which then pull secondary payloads from adversary-controlled infrastructure.
Detects anomalous PowerShell activity associated with the EKZ Stealer, characterized by a multi-stage chain involving file download, hidden process execution, temporary file staging, base64 encoding, and exfiltration via HTTP POST requests, followed by cleanup of logs.
Detects the execution of PowerShell with the encoded command parameter (-encodedcommand or -enc), followed by a substantial base64-encoded string. This is a common technique used by attackers to obfuscate malicious PowerShell scripts, bypass signature-based detection, and execute payloads in memory.
Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.
Page 35 of 91