Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects instances of PowerShell executing Base64-encoded commands initiated by Windows Explorer, a common technique used in the Potemkin Loader/ClickFix campaign to evade static analysis and security controls.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.
Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.
Detects the execution of known Active Directory enumeration tools (BloodHound/SharpHound, AdFind) and command-line techniques (net group /domain, PowerView cmdlets) that are frequently associated with reconnaissance activities by threat actors like Akira affiliates, particularly when initiated from non-standard or unmanaged endpoints.
Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.
Detects execution of PowerShell processes spawned by script hosts (wscript.exe, mshta.exe) with common bypass/encoded flags. The rule identifies suspicious command-line patterns involving known malicious infrastructure domains or specific suspected payload filenames, indicative of the Millenium RAT dropper activity.
Detects execution of PowerShell commands indicative of Gamaredon (Shuckworm) threat group activity. The rule monitors for PowerShell processes utilizing command-line arguments typical of their 2025 downloader toolset (such as PteroPaste, PteroDee, and PteroCache), specifically combining encoded commands, in-memory execution (IEX/Invoke-Expression), and remote file fetching (DownloadString).
Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.
Detects the execution of PowerShell via explorer.exe containing a long Base64-encoded command string, which is characteristic of the Potemkin Loader used in ClickFix-style attacks to evade detection.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects malicious network discovery and enumeration activities associated with Akira ransomware. This includes the execution of SoftPerfect Network Scanner (netscan.exe) for port/service scanning and the use of the PowerView Invoke-ShareFinder module for identifying accessible network shares, often observed in post-compromise intrusion phases.
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.
Page 41 of 91