Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell scripts that query the system's total physical memory and compare it against common low-resource thresholds (e.g., < 4GB). This is a known sandbox evasion technique used by malware to identify and avoid analysis environments, which are often configured with limited RAM.
Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.
Detects PowerShell scripts using Windows API calls for parent process ID spoofing, enabling malicious processes to masquerade as legitimate system processes.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects a PowerShell process that downloads a ZIP archive and extracts it to the ProgramData directory. This behavior is characteristic of the final stage of the JS#SMUGGLER campaign, which uses this technique to deploy the NetSupport RAT.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects remote command execution via PowerShell's Invoke-Command, a technique used by The Gentlemen ransomware for lateral movement and deploying payloads.
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Detects a Python process creating a scheduled task or adding a Windows Defender exclusion, a technique used by malware like InvisibleFerret for persistence and defense evasion.
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects token obfuscation techniques commonly used by Invoke-Obfuscation within PowerShell scripts. This rule is designed to identify highly obfuscated PowerShell code that attempts to evade detection by manipulating string formatting, environment variables, and character escaping. It can be used as a threat-hunting baseline to find suspicious scripts in an environment.
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
Detects PowerShell execution patterns consistent with the Caminho Loader, which uses LSB steganography to extract a payload from a downloaded image file. This rule requires PowerShell Script Block Logging (Event ID 4104).
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
This rule detects the creation or registration of scheduled tasks using PowerShell cmdlets or WMI methods. It specifically looks for the use of `New-ScheduledTaskAction`, `New-ScheduledTaskTrigger`, `New-ScheduledTaskPrincipal`, `New-ScheduledTaskSettingsSet`, `New-ScheduledTask`, `Register-ScheduledTask` cmdlets, or the `Invoke-CimMethod` cmdlet targeting the `PS_ScheduledTask` class within the `Root\Microsoft\Windows\TaskScheduler` namespace. This activity is often abused by adversaries for persistence, privilege escalation, and execution.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
Page 65 of 91