Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects attempts to patch AMSI (Antimalware Scan Interface) managed methods in PowerShell memory using JIT (Just-In-Time) compilation and memory write operations. The rule identifies suspicious combinations of terms related to method preparation, memory manipulation (via System.Runtime.InteropServices.Marshal), and direct references to AMSI components within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Anti-Malware Scan Interface (AMSI) by identifying malicious memory modifications or reflective script patterns commonly used to patch AMSI in memory. This rule correlates process-level memory events (VirtualProtect) with PowerShell ScriptBlock logging (Event ID 4104) to identify tampering with amsi.dll or AmsiScanBuffer.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 (pwsh.exe) by utilizing System.Reflection.Emit to dynamically emit Intermediate Language (IL) code. This technique involves JIT heap patching where an attacker constructs a dynamic method to intercept or nullify AMSI scan functions (e.g., AmsiScanBuffer) within the runtime memory of the PowerShell process.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) following the reconnaissance of security software or AMSI providers. It correlates WMI or registry-based discovery activities concerning security products or AMSI configurations with subsequent PowerShell-based AMSI bypass indicators (such as specific strings or method names indicative of memory patching) occurring on the same host within a 10-minute window.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
This rule detects potential malicious activity where a PowerShell process first attempts to bypass the Antimalware Scan Interface (AMSI) and subsequently executes code characteristic of a reverse shell or network-based command execution within a 10-minute window. This sequence is a common pattern for fileless malware or remote access trojans (RATs) attempting to evade detection and maintain persistence.
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Detects the execution of the Nishang 'Invoke-PowerShellTcp' reverse shell payload via PowerShell. This rule monitors for common obfuscated patterns involving IEX (Invoke-Expression) and 'DownloadString' commonly used to download and execute scripts directly into memory, often following an AMSI bypass attempt.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
This rule detects a sequence of events where a new local account is created on a device using common administrative commands (net user, PowerShell New-LocalUser), followed within 60 minutes by the execution of known offensive security tools or frameworks such as Impacket, NetExec, CrackMapExec, Chisel, or Havoc agent on the same device. This pattern is indicative of potential unauthorized system access, staging of persistence mechanisms, or active reconnaissance activities.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
Detects reconnaissance activity where PowerShell is used to enumerate installed software by querying Windows registry uninstall keys (HKLM and HKCU) via cmdlets such as Get-ItemProperty, Get-StartApps, or Get-AppxPackage. This behavior is associated with the ROOTBOY/Prinz Eugen campaign, typically performed as a precursor to ransomware deployment.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects the use of PowerShell to initiate web requests to Storj-hosted URLs (link.storjshare.io or .storj.io), utilizing either the WebClient class or the Invoke-WebRequest cmdlet. This behavior is associated with the REF8372 OXLOADER malvertising campaign, where PowerShell scripts are used to download malicious payloads.
Page 54 of 91