Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
Detects a PowerShell command used to read its own batch script container (e.g., rEgX.cmd) to find and extract a hidden, encoded payload. This self-parsing technique is a core feature of the Dead#Vax malware.
Detects a PowerShell script attempting to read the content of a command or batch file (.cmd) to extract a payload. This technique was observed in the DeadVax campaign where a batch script invokes PowerShell to parse its own content, looking for a line starting with '@' which contains the next stage's Base64-encoded payload.
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
Detects PowerShell commands used by Prometei to add Microsoft Defender exclusions for its staging and configuration directories ('C:\Windows\Dell' or 'Intel\Support'). This is a common defense evasion tactic.
An attacker disables or weakens Windows auditing to reduce the visibility of system and user activity. This helps evade detection by security tools and analysts by preventing critical events from being recorded in Windows Event Logs.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects PowerShell commands using the call operator '&' with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule detects PowerShell being used to add Windows Defender exclusions for file paths and processes associated with the ValleyRAT malware campaign. Specifically, it looks for `Add-MpPreference` command-line arguments that include `-ExclusionPath` with "trvePath" or `-ExclusionProcess` with "WavesSvc64.exe".
Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.
This rule detects suspicious DNS queries made by common Windows command-line interpreters and scripting engines. It specifically looks for `nslookup.exe` or `dig.exe` being spawned by `cmd.exe`, `powershell.exe`, `pwsh.exe`, `explorer.exe`, `wscript.exe`, `cscript.exe`, or `mshta.exe`. The detection is further refined by looking for specific DNS query types (TXT, MX, SRV, AAAA), service records (`._tcp.`, `._udp.`), or `.onion` domains in the command line. Additionally, it requires corroboration through the presence of an IP address or `-server=` in the command line, or specific PowerShell/command-line obfuscation/execution techniques, or suspicious top-level domains (TLDs) like `.xyz`, `.top`, `.tk`, `.ru`, `.cn`, `.cc`, `.ws`, `.pw`, `.onion`, `.direct`, `.surf`. The rule explicitly excludes queries to `localhost` or common legitimate DNS records like `_dmarc.`, `_dkim.`, `_spf.`, `_acme-challenge.`, `_domainkey.`, `_msdcs.` to reduce false positives.
Detects PowerShell execution containing multiple repeated empty-string literal patterns such as "" or '' (including variants with whitespace), often used in trivial string-obfuscation techniques observed in malicious scripts. The regex is greedy so per environment tuning may be necessary.
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
Query identity the deletetion of the file ConsoleHost_history.txt, the file stores the process command line history of Powershell
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
Detects a potentially suspicious powershell script executions from temporary folder
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Page 64 of 91