Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects the execution of a malicious PowerShell loader associated with the UAC-0226 threat actor. The loader employs a 60-second sleep delay using the Start-Sleep cmdlet to evade automated sandbox analysis before proceeding to reflectively load the GIFTEDCROOK payload from a file located in C:\ProgramData\WC3.
Detects the use of System.Reflection.Emit.DynamicMethod and ILGenerator in PowerShell 7 scripts to perform an AMSI bypass. The attack works by emitting IL opcodes to directly modify the internal 's_amsiInitFailed' field within the AmsiUtils class, bypassing the initonly constraint to disable AMSI scanning.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or PowerShell's 'Register-ScheduledTask' cmdlet. The detection focuses on command lines that include indicators of suspicious activity, such as encoded commands, hidden window styles, or placement in temporary or application data directories, specifically when the initiating process is not a signed Microsoft binary.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) containing command line arguments indicative of malicious activity, including encoded commands, memory loading, assembly loading, thread creation, or attempts to bypass AMSI (Antimalware Scan Interface). The rule specifically excludes processes signed by Microsoft to reduce false positives.
Detects attempts to clear Windows event logs using native utilities (wevtutil), remove shell history files (bash_history, PowerShell history), or perform secure file deletion using cipher.exe, which are techniques commonly used by attackers to remove forensic evidence of their activities.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin, WMIC, or PowerShell. Attackers commonly perform this action to inhibit system recovery and prevent the restoration of data, often as a precursor or during the impact phase of ransomware attacks.
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects signs of access token manipulation and impersonation, including the use of 'runas' with saved credentials, suspicious PowerShell API calls for identity management, usage of known token-manipulation tools (e.g., incognito), and reconnaissance using 'whoami /priv'. These activities are indicative of privilege escalation attempts or lateral movement.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
Page 42 of 91