Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the Pay2Key ransomware's use of a polyglot setup.cmd script that executes embedded PowerShell code in-memory. The detection focuses on PowerShell being launched with the '-nop' flag and a specific pattern using [io.file]::ReadAllText($env:0) to read and execute the script's own content, a technique characteristic of Pay2Key's fileless execution.
Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
This rule detects PowerShell commands or script block executions involving the creation of desktop shortcuts associated with the VILE ransomware decryptor. The rule specifically looks for the usage of WScript.Shell, the -NoProfile flag, and references to 'vile_Decryptor' or 'vile_icon.ico' in the command line or script content.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
Detects the execution of 'tango13.ps1', a PowerShell payload associated with the Iranian APT group MuddyWater (also known as Seedworm or APT33), which has been observed being dropped via Microsoft Teams.
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Correlates the runtime replacement of junk encoding markers (DGtre) with standard Base64 characters within the payload, often seen in Vidar malware's obfuscation techniques.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Detects the creation of new local user accounts by monitoring for the 'net user /add' command or the 'New-LocalUser' PowerShell cmdlet. This activity is commonly used by malware, such as Amadey and StealC, to establish persistence on a compromised system.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.
Detects a suspicious pattern consistent with the REF8372 OXLOADER malware delivery, where a batch file (BAT) is executed from the Downloads or Temp directories using cmd.exe, which then spawns PowerShell to download external content from link.storjshare.io.
Page 56 of 91