Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.
Detects instances where PowerShell is executed via the Windows Run dialog (explorer.exe), utilizing common download-cradle patterns (IEX/Invoke-Expression and Invoke-RestMethod) typically associated with ClickFix clipboard-hijacking social engineering campaigns.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
This rule detects attempts to clear Windows event logs using either the 'wevtutil.exe' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. Adversaries often clear event logs to hide evidence of their activity on a compromised host.
Detects the use of PowerShell to forcefully terminate 'wscript.exe' using 'Stop-Process' or 'taskkill'. This behavior is associated with adversaries, such as those in the VEIL#DROP campaign, attempting to minimize forensic evidence after executing malicious JavaScript lures via Windows Script Host.
The analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.
Detects an obfuscation technique where a threat actor hides Invoke-Expression (IEX) execution by using Get-Variable to parse out IEX characters from the MaximumDriveCount built-in variable and reconstruct them via -Join.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects the creation of specific shortcut files (.lnk) or the use of WScript.Shell and CreateShortcut methods within PowerShell, associated with the VILE ransomware's fake decryptor lure technique.
Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.
Detects instances where cmd.exe spawns powershell.exe with command-line arguments indicative of malicious activity, such as network connection attempts via TCPClient or the use of Base64 encoded commands.
Detects the execution of PowerShell with flags indicating encoded commands (-enc) or hidden window styles (-windowstyle hidden), which are common techniques used to obfuscate malicious activity or run payloads stealthily. This behavior is often associated with the post-compromise execution phase of various threats, including payloads delivered via malicious portals.
Detects attempts to clear Windows Event Logs using either the command-line utility 'wevtutil.exe' or the PowerShell cmdlet 'Clear-EventLog'. Additionally, it monitors for Windows Security Event ID 1102, which specifically indicates the clearing of the Security log. These actions are common indicators of an adversary attempting to remove evidence of their activity from a host system.
Detects persistence mechanisms associated with the UAC-0226 threat actor by identifying a LNK shortcut file located in the user Startup folder that executes a minimized cmd.exe process. This command shell subsequently launches a hidden PowerShell command that reads and executes code from C:\ProgramData\WC3 using Invoke-Expression (IEX). This activity is linked to the GIFTEDCROOK delivery chain.
Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.
Detects the creation or registration of virtual machines across multiple hypervisor platforms (Hyper-V, VMware ESXi, and VirtualBox) using PowerShell, command-line utilities, or security event logs. The rule alerts on these actions when performed outside of designated business hours or by accounts not included in a pre-defined list of authorized administrators.
Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.
Detects the execution of PowerShell commands initiated directly from explorer.exe that contain indicators of the 'ClickFix' attack vector, specifically commands designed to extract data from the clipboard (e.g., Get-Clipboard) or download/execute remote content (e.g., iwr, iex). This activity typically occurs when a user is socially engineered into copying and pasting malicious instructions into the Windows Run dialog.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Page 36 of 91