Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool for administering Azure AD and Office 365, which can be abused by threat actors to attack these services. The rule specifically looks for PowerShell processes executing commands containing the unique string "-AADInt" followed by various cmdlet actions like Add, ConvertTo, Disable, Enable, Export, Find, Get, Grant, Initialize, Install, Invoke, Join, New, Open, Read, Register, Remove, Reset, Resolve, Restore, Save, Search, Send, Set, Start, Unprotect, or Update.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects suspicious PowerShell invocation command parameters
Detects suspicious PowerShell invocation command parameters
Detects the execution of the Evil-WinRM hack tool by identifying specific hardcoded strings within PowerShell Module logs. This rule looks for patterns associated with Evil-WinRM's functionality, such as specific PowerShell commands for file operations, binary invocation, and registry queries, executed within the context of wsmprovhost.exe.
Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
This rule detects the execution of a PowerShell script that utilizes the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This combination is a strong indicator of potential data exfiltration via email, where an adversary might be sending sensitive files as attachments through SMTP. The rule aims to identify attempts to steal data by exfiltrating it over an unencrypted network protocol, specifically SMTP, to an alternative network location.
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. This rule specifically looks for the `Set-MpPreference` cmdlet combined with various parameters that disable Defender features or set threat actions to 'Allow'.
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.
Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.
Detects when one of the critical Windows Event Logs (PowerShell, Sysmon, Security, System) is cleared. This activity is often performed by adversaries to remove traces of their actions and evade detection. The rule specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider across these important channels.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
This rule detects PowerShell script block text that attempts to modify file timestamps (creation, last write, or last access times). This technique, known as timestomping, is often used by adversaries to hide new or modified files by making them appear to have older timestamps, blending them with legitimate files on the system.
This rule detects the execution of the PowerShell cmdlet 'Enable-PSRemoting'. This cmdlet configures the computer to receive PowerShell remote commands, which adversaries may use for lateral movement and remote execution. Detection relies on Script Block Logging being enabled to capture the cmdlet's execution.
This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.
Page 78 of 91