Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the execution of PowerShell commands commonly used for host reconnaissance (e.g., whoami, ipconfig, net group, systeminfo) combined with the use of PowerShell to perform an HTTP POST request to a suspicious external IP address (202.182.102.5), suggesting post-compromise reconnaissance data exfiltration.
This rule detects network connections initiated by common Windows script interpreters (PowerShell, WScript, CScript, MSHTA) to known public paste or text sharing services. Adversaries often use these sites to host malicious payloads, C2 configurations, or to exfiltrate data, bypassing traditional network blocks by using reputable services. The rule excludes processes signed by Microsoft to reduce noise.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects the execution of PowerShell with a Base64-encoded command line originating from Windows Explorer, a behavior consistent with the Potemkin Loader and ClickFix attack campaigns used to bypass string-based detection.
Detects the abuse of GitLab Runner to establish a C2 channel via malicious PowerShell script blocks. The rule identifies anomalous combinations of GitLab CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none, CI_JOB_NAME=run_command) and the execution of arbitrary commands (IEX $env:CMD) within PowerShell script block logging (Event ID 4104).
Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects automated scripts or command-line utilities initiating connections to Microsoft authentication endpoints using OAuth device code authorization parameters. This behavior is indicative of PhaaS (Phishing-as-a-Service) tools, such as EvilTokens, attempting to perform device code OAuth flows on behalf of an attacker to gain unauthorized access.
Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects WMI-based process execution (T1047) where a script interpreter (wscript.exe/cscript.exe) executes a JavaScript or script file, followed within 30 seconds by WmiPrvSE.exe spawning PowerShell. This reconstructs the broken process chain created when scripts use WbemScripting.SWbemLocator and Win32_Process.Create() to proxy execution through WMI.
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Why suspicious: Legitimate use of WMI to spawn interactive shells is rare. This technique is specifically used to sever the parent-child process relationship between the initial script host and PowerShell, evading parent-process-based EDR detections and allowlist rules.
Observed in: Remcos RAT campaigns using VHDX-packaged JavaScript loaders, but the technique is not exclusive to this malware family.
MITRE ATT&CK: T1047 - Windows Management Instrumentation
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
Detects suspicious PowerShell command-line activity commonly associated with malicious scripts, including execution bypass (e.g., -ep bypass), the use of .NET BigInteger for potential obfuscation, and downloading files via Invoke-WebRequest to the temp directory. The rule further increases fidelity by identifying if the parent process is a common execution vector such as explorer.exe, wscript.exe, or mshta.exe.
Detects the execution of PowerShell with suspicious flags, obfuscation, or download cradles often used by the SystemBC/Coroxy malware to facilitate second-stage payload delivery and C2 activity.
Detects malicious use of PowerShell cmdlets to modify Group Policy Objects (GPOs) for ransomware distribution. The rule monitors for execution of GPO management cmdlets in conjunction with specific ransomware indicators, such as disabling Windows Defender real-time monitoring, modifying GPO machine extension names, or targeting SYSVOL/NETLOGON network shares.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
Detects user-initiated PowerShell execution patterns associated with Woodgnat social engineering campaigns (ClickFix, FileFix, CrashFix). The rule monitors for PowerShell processes spawned by common communication and web browsing applications (Microsoft Teams, Chrome, Edge, Firefox) or script interpreters (mshta, wscript) that utilize obfuscation or non-interactive flags common in these attack vectors.
Page 43 of 91