Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, such as modifying AmsiUtils, AmsiScanBuffer, or related reflection-based obfuscation in process command lines.
This rule detects instances where PowerShell or PowerShell Core (pwsh.exe) are spawned as child processes of common COM object host processes (e.g., wscript.exe, mshta.exe, rundll32.exe). The detection specifically looks for command-line arguments containing encoded commands or indicators of download cradles (e.g., IEX, Net.WebClient, DownloadString), which are common patterns for fileless execution and malicious script staging.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
This rule detects activities aimed at inhibiting system recovery by identifying attempts to delete volume shadow copies via vssadmin, wmic, or powershell, in combination with disabling windows recovery mode using bcdedit. This behavior is indicative of ransomware preparation, where an adversary attempts to prevent the restoration of data before encryption.
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.
This rule detects the use of BITSAdmin and PowerShell's Start-BitsTransfer utility to download files from known malicious or suspicious GitHub repositories and specific filenames associated with campaign activity.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects execution of PowerShell scripts associated with ErrTraffic (ClickFix) campaigns. The rule identifies malicious patterns, including the use of hex-encoded XOR operations, specific browser update comment markers, and the dynamic creation of ScriptBlocks to facilitate payload execution.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.
Detects the execution of PowerShell with the '-ExecutionPolicy Bypass' flag to interact with BitLocker-related cmdlets (Suspend-BitLocker or Get-BitLockerVolume). This pattern is often associated with adversary attempts to weaken or assess disk encryption protections, a technique commonly used by ransomware actors.
Detects the execution of PowerShell commands intended to suspend BitLocker protection on system volumes. This behavior is indicative of VILE ransomware attempting to disable volume encryption to facilitate further malicious activity or file encryption.
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Detects persistence mechanisms associated with the Gamaredon Group (also known as Shuckworm/ACTINIUM) involving the Ptero-family of malware. The rule identifies suspicious combinations of encoded PowerShell commands (using -EncodedCommand, IEX, or FromBase64String), registry modification to Windows Run/RunOnce keys referencing suspicious interpreters (wscript, mshta, powershell, rundll32) within user profile paths, and command-line indicators of C2 activity such as DownloadString/WebClient or specific .ru/.online domain patterns.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
Page 49 of 91