Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the use of PowerShell to modify Microsoft Defender preferences by adding an exclusion path. This activity is commonly used by adversaries to prevent security software from scanning specific directories where malicious tools or payloads are staged.
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects execution of PowerShell commands associated with the Pay2Key ransomware, specifically searching for command lines that reference bin-staged payloads (data1.bin, data2.bin, data3.bin) and a hardcoded XOR key (12199) used to deobfuscate the payloads in memory before execution via Invoke-Expression or similar methods.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
This rule detects potential tunnel creation using PowerShell. It identifies network connections from PowerShell processes to common SSH (22) or Tor (9001, 9050) ports, as well as PowerShell script block activity involving socket connections directed at .onion domains, SSH keys, or authorized keys files, which may indicate remote access tunneling or command-and-control communication.
This rule detects various User Account Control (UAC) bypass techniques (such as fodhelper.exe or eventvwr.exe hijacking), registry modifications involving 'ms-settings' classes, and the use of 'Start-Process -Verb RunAs' to request administrative privileges. It also flags potentially elevated installations of OpenSSH or Tailscale, which are commonly targeted by attackers following privilege escalation.
Detects evidence of log and artifact tampering on a Windows host, specifically the clearing of Windows System or Security logs using wevtutil or PowerShell, the stopping of the EventLog service, or the deletion of PowerShell PSReadLine history files. Such activity is often conducted by an adversary to conceal malicious actions.
Detects the execution of PowerShell with the EncodedCommand (-enc/-e/-ec) argument, which is frequently used by adversaries to hide malicious scripts and bypass simple command-line inspection. The rule excludes processes signed by Microsoft to reduce noise from legitimate system administration scripts.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
Page 40 of 91