Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the execution of a Nuitka-compiled Python RAT (chost.exe) associated with the PostCSS typosquatting campaign. The rule identifies this malicious binary when spawned by wscript.exe, powershell.exe, or node.exe from a location outside of C:\Windows\, followed by network communication to known campaign-associated C2 infrastructure.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Detects high-frequency reconnaissance activity on endpoints involving process enumeration and file/directory discovery. This behavior is commonly observed in the pre-ransomware phase as adversaries map out the environment, and is consistent with TTPs employed by threat actors such as BlackBasta, including the use of native administrative tools (e.g., tasklist, dir, tree, net share) and PowerShell commands for discovery.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
This rule detects attempts to delete Volume Shadow Copies (VSS) using native Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. Attackers often perform this action during the impact phase to prevent file recovery after ransomware deployment or other data destruction activities.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects the GitLab Runner process (gitlab-runner-windows-amd64.exe) spawning PowerShell with command-line arguments indicative of a C2 framework or manual operator interaction, such as '-NoProfile', '-NonInteractive', '-ExecutionPolicy Bypass', and '-Command'. The rule specifically targets instances where these processes are executed under the SYSTEM account, a behavior commonly associated with exploiting CI/CD runners for persistent command execution.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Page 51 of 91