Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
This rule detects suspicious process execution patterns that are characteristic of fileless malware execution or malicious script handling. It specifically targets PowerShell commands using ReadAllText to read script content from stdin/env:0, the use of Sysnative paths for architectural bypasses, and the execution of setup.cmd files from 7Zip extraction directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects the execution of PowerShell from explorer.exe (the Windows Shell) involving commands that access the clipboard, which is a common indicator of the ClickFix social engineering attack technique. In this scenario, users are deceived into copying and pasting malicious commands into the Run dialog.
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
This rule detects instances where PowerShell or PowerShell Core (pwsh.exe) are spawned as child processes of common COM object host processes (e.g., wscript.exe, mshta.exe, rundll32.exe). The detection specifically looks for command-line arguments containing encoded commands or indicators of download cradles (e.g., IEX, Net.WebClient, DownloadString), which are common patterns for fileless execution and malicious script staging.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
This rule detects a remote interactive logon (Logon Type 10) via RDP, followed by a PowerShell process executing 'net.exe' with sensitive administrative arguments such as 'administrator', '/active:yes', or '/dom'. This pattern is highly indicative of an adversary attempting to elevate privileges or modify domain/local account properties after establishing initial access via Remote Desktop.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
This rule detects suspicious PowerShell script behavior that attempts to patch the Anti-Malware Scan Interface (AMSI) in-memory by manipulating internal .NET/CLR methods. It identifies the combination of dangerous API calls (e.g., VirtualProtect, Marshal.Copy, PrepareMethod) typically used to bypass AMSI scanning via JIT compilation patching targeting the WinScanContent method.
This rule detects potential attempts to disable Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 using reflection-based manipulation of the amsiInitFailed boolean field in the System.Management.Automation.AmsiUtils class. Attackers often use obfuscation techniques such as splitting strings or using reflection methods to bypass static security signatures.
Detects execution of PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by dynamically creating methods using System.Reflection.Emit. It looks for specific keywords associated with reflection-based AMSI tampering, such as creating dynamic methods, accessing internal IL generators, and explicitly targeting AMSI-related memory structures like amsiContext or s_amsiInitFailed.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.
This rule detects the use of native Windows utilities such as nltest.exe, netdom.exe, and PowerShell to enumerate Active Directory domain trust relationships. Attackers commonly perform this discovery to map out target environments, identify lateral movement opportunities, or plan further exploitation in multi-domain or forest environments.
This rule detects potential Active Directory enumeration attempts by monitoring for the execution of common command-line tools and PowerShell cmdlets used to query domain information, such as users, groups, and domain controllers.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. Specifically, it looks for PowerShell command or script block execution events containing the string patterns "-bxor[int][char]$" and "[convert]::ToInt32", which are indicative of the custom XOR decryption and type conversion methods employed by this malware distribution framework.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Detects the use of the AADInternals PowerShell module for suspicious device registration activities, such as phantom device creation and Primary Refresh Token (PRT) manipulation, which are common techniques used to bypass Conditional Access policies. The rule correlates PowerShell command execution containing AADInternals cmdlets with subsequent Azure AD device registration events originating from the same host within a 15-minute window.
Page 44 of 91