Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
This analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. This activity is significant as adversaries may use unsigned AppX packages to install malicious applications, bypass security controls, or establish persistence. If confirmed malicious, this could allow attackers to install unauthorized applications that may contain malware, backdoors, or other malicious components.
Detects PowerShell preparing to execute shellcode using the CallWindowProc API. This technique is used to bypass EDRs by executing code without creating a new thread, which is a commonly monitored API call.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects reflective loading of .NET assemblies from memory within PowerShell. This technique is often used to execute malicious code while bypassing file-based detections and some AMSI features, as the assembly is loaded directly from a byte array rather than from a file on disk.
This rule detects the creation of a Volume Shadow Copy using PowerShell, specifically looking for the `Win32_ShadowCopy` WMI class and the `.Create()` method with the `ClientAccessible` parameter. Adversaries often use Volume Shadow Copies to access or copy the Active Directory domain database (NTDS.dit) to steal credential information, or other sensitive data from the local system.
This rule detects PowerShell script blocks that attempt to bypass AMSI (Antimalware Scan Interface) by patching or manipulating memory related to AMSI. It specifically looks for the presence of keywords like 'VirtualProtect', 'GetProcAddress', 'InteropServices', 'AmsiScanBuffer', and references to 'amsi.dll' or 'clr.dll' within PowerShell operational logs (EventID 4104). This combination of keywords indicates an attempt to programmatically interfere with AMSI's ability to scan script content.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
Detects PowerShell obfuscation techniques in process command lines, including encoded commands, IEX with string manipulation, and long command lines with string functions, indicating potential malicious activity. The rule specifically looks for the use of '-encodedcommand' or its short forms with long command lines, 'iex' or 'invoke-expression' combined with string manipulation (like '+', '-join', '[char]', 'frombase64string') or very long command lines, and unusually long command lines that also contain string manipulation functions ('-join', 'replace', 'split').
Detects the usage of PowerDodder, a post-exploitation persistence tool that appends malicious commands to existing script files by hijacking their execution flow.
Detects instances where PowerShell is used to download content from external domains using common web request methods (Invoke-WebRequest, iwr, wget, DownloadFile, DownloadString). This behavior is frequently observed during the initial stages of malware delivery, including payload staging or C2 beaconing. The rule excludes known benign sources like slackb.com/error and chocolatey and filters out system-level accounts to reduce false positives.
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
This rule detects suspicious PowerShell command patterns associated with the Chaos ransomware group. These commands are used for environment setup, preparing for large file downloads, and remote command execution.
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
CVE-2025-53770 is a critical zero-day vulnerability in on-premise Microsoft SharePoint Server, actively exploited in the wild, allowing unauthenticated remote code execution (RCE) with a CVSS score of 9.8. This means attackers can execute arbitrary code on a vulnerable server without needing login credentials.
This rule detects the presence of a plain text artifact in a common download scenario in PowerShell where the second required portion of the command is not present. This could be an attempt to obfuscate the script in order to evade detections.
Page 68 of 91