Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the use of Windows Package Manager (winget) or Configuration Remoting Server processes to execute account management commands such as adding users or modifying group memberships via net.exe or PowerShell. This behavior is indicative of privilege escalation or persistence attempts using legitimate administrative tools.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects cmd.exe spawning powershell.exe with command-line arguments indicative of a reverse shell, specifically leveraging encoded commands or TCP socket objects. This pattern is characteristic of attackers injecting malicious keystrokes via the Remote Mouse Socket.IO service.
Detects the execution of PowerShell commands targeting a specific staging directory 'ProgramData\Zooms', typically associated with the ClickFix malware campaign. The rule flags processes invoking secondary payload retrieval via '.r2.dev' or 'dl-callback' patterns, which are indicative of staged second-stage download activities.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Unrestricted) originating from the ScreenConnect SystemTemp directory. This behavior is consistent with malicious campaigns, such as those deploying AsyncRAT via trojanized installers, that utilize the ScreenConnect temporary storage path to stage and execute secondary malicious payloads.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects the use of .NET reflection within PowerShell to access the 'AmsiUtils' class and set the 'amsiInitFailed' field to true. This technique effectively disables the Antimalware Scan Interface (AMSI) for the current PowerShell process, allowing subsequent malicious code or scripts to execute without being scanned for threats.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
Detects the creation or modification of inbox rules via PowerShell, specifically targeting cmdlets commonly used by attackers to hide phishing indicator emails, security alerts, or C2 communications by moving or deleting them into folders like Junk, Deleted Items, or Archive. The rule monitors for both direct usage on the endpoint and remote administration patterns via Exchange Online/EWS remoting.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window style, or specific payload strings like 'MiniJunk') originating from common file staging directories (e.g., Downloads, Temp, AppData). This pattern is often indicative of malicious post-lure payload execution.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by utilizing .NET reflection and IL generation. This technique involves creating dynamic methods and emitting instructions to manipulate the memory space of AmsiUtils, effectively disabling or blinding AMSI during script execution.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.
Page 37 of 91