Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects PowerShell commands that perform XOR decryption of an embedded payload using the hardcoded key 'Pussecretvk456' and subsequently use [System.Reflection.Assembly]::Load to reflectively load the resulting .NET assembly into memory. This behavior is indicative of fileless execution patterns commonly observed in the LokiBot and Amadey malware families.
Detects the execution of PowerShell scripts from the Windows Temp directory using common evasion flags (-NoProfile, -ExecutionPolicy Bypass, -WindowStyle Hidden). This pattern is consistent with loaders attempting to maintain persistence while obfuscating their execution context, specifically associated with steganographic malware campaigns.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.
Detects anomalous PowerShell process execution by monitoring for indicators of obfuscation, use of download cradles, and execution from suspicious parent processes. This detection specifically aligns with techniques associated with the Millenium RAT C++ v4.x stagers, flagging processes that exhibit multiple risk indicators simultaneously.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects the execution of PowerShell with suspicious command-line arguments, including obfuscation techniques like base64 encoding, attempts to hide the console window, and strings associated with Pterodo-related tools or backdoors.
Detects sandbox evasion techniques used by the Gamaredon group's PteroSand malware. The rule monitors for WMI queries against system artifacts (Win32_ComputerSystem, Win32_BIOS, or Win32_VideoController) searching for virtualization-related strings (vmware, vbox, etc.), followed by a mandatory sleep/timeout delay of at least 60 seconds, and concludes by identifying the subsequent execution of a new process within the same lineage.
Detects the execution of PowerShell with encoded commands initiated by common office applications (e.g., WinWord, Excel) or scripting engines (e.g., wscript, mshta). The rule specifically targets command lines longer than 200 characters that are not digitally signed by Microsoft, often indicating obfuscated malicious payloads intended to evade detection.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
This rule detects the suspicious creation or modification of high-privileged accounts (Domain Admins, Enterprise Admins, Administrators) using net.exe or net1.exe. It triggers when these commands are executed via PowerShell or cmd.exe, originating from suspect parent processes (WmiPrvSE.exe, mstsc.exe, etc.), and specifically monitors for a pattern of creating the same new account across multiple distinct hosts within a short 30-minute window, excluding accounts that existed in the prior 24-hour baseline.
Page 47 of 91