Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) using .NET reflection techniques. It specifically looks for patterns involving the manipulation of internal AMSI fields, such as 'AmsiUtils', 's_amsiInitFailed', and 'DynamicMethod', which are common indicators of malicious attempts to disable or evade script content analysis in memory.
Detects the execution of PowerShell processes where command lines contain references to Nishang framework scripts, 'Invoke-PowerShellTcp' reverse shell patterns, or indicators of attempts to bypass the Antimalware Scan Interface (AMSI) such as 'AmsiScanBuffer' or 'amsiInitFailed'.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).
Detects a suspicious execution chain where a command prompt (cmd.exe) launched from a Startup LNK context initiates a hidden PowerShell process with Execution Policy bypass flags. This pattern is often associated with fileless malware execution, specifically linked to UAC-0226 activity, aiming to execute obfuscated PowerShell scripts by reading payloads from memory or staged files.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common reflection-based patterns, such as accessing 'AmsiUtils', modifying 'amsiInitFailed' flags, or using 'BindingFlags' to manipulate non-public members. These techniques are commonly used to disable AMSI scanning within a malicious PowerShell script's memory space.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
This rule detects PowerShell script block execution containing indicators commonly associated with JIT heap memory manipulation and AMSI bypass techniques. It uses a scoring system based on the presence of specific .NET classes and methods used to allocate, copy, and change protection on memory pages, which are typical of fileless payload execution and security feature subversion.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Detects PowerShell scripts attempting to tamper with or bypass the Antimalware Scan Interface (AMSI) by reflecting on the 'AmsiUtils' class within the 'System.Management.Automation' assembly. This activity is a common technique used by adversaries to execute malicious scripts without security product intervention.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects the use of System.Reflection.Emit.DynamicMethod in PowerShell to dynamically compile and execute Intermediate Language (IL) code. This technique is commonly used to patch AMSI internals, specifically by modifying 's_amsiInitFailed' to bypass scanning capabilities.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.
Detects sophisticated AMSI bypass attempts in PowerShell sessions. The rule monitors for a combination of techniques, including patching the 'InternalNotify' function in the AMSI vtable using 'VirtualProtect', and leveraging 'Marshal.WriteInt64' to nullify critical security scan paths ('WinScanContent' and 'WinReportContent') in memory.
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by manipulating memory structures or using reflection to nullify security checks. The rule looks for signatures of commonly used bypass techniques, such as using Marshal to overwrite amsiContext, calling GetDelegateForFunctionPointer with null/IntPtr.Zero arguments to target AmsiInitialize/AmsiScanBuffer, or declaring unusual DllImport signatures for amsi.dll functions within PowerShell script blocks.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 5.1 by using .NET reflection to manipulate the 'amsiInitFailed' field within the 'AmsiUtils' class. The rule monitors both script block logs and command-line arguments for patterns involving reflective field access, string concatenation of sensitive keywords, and reflection binding flags.
Page 53 of 91