Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects execution of PowerShell commands originating from a batch (.bat/.cmd) script that utilize .NET WebClient methods (DownloadString/DownloadFile) combined with process execution cmdlets (Start-Process/Invoke-Expression/IEX). This pattern is associated with the delivery and execution of the OXLOADER malware via BATPackageBuilderSetup.bat.
Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects the execution of Invoke-SMBRemoting for fileless lateral movement, specifically looking for PowerShell processes with 'Invoke-SMBRemoting' in their command line.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Identifies the execution of IEX (New-Object Net.WebClient).DownloadString directly from a run prompt, avoiding disk writes entirely. This rule specifically looks for PowerShell command-line activity where 'IEX' is used in conjunction with 'New-Object Net.WebClient).DownloadString', indicating an attempt to download and execute content directly in memory.
Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup. This technique was observed in a campaign deploying obfuscated batch scripts disguised as PNG files into the Startup folder.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Page 57 of 91