Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects the use of '.CopyFromScreen' within PowerShell script block text. This API call is commonly used by adversaries to capture screenshots of the desktop, which is a technique for gathering information during an operation. The detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
This rule detects the installation of a root certificate on a Windows system via PowerShell. It specifically looks for PowerShell script block text containing commands like 'Move-Item' or 'Import-Certificate' targeting the 'Cert:\LocalMachine\Root' path. Adversaries may install root certificates to bypass security warnings when connecting to their controlled web servers, facilitating man-in-the-middle attacks or credential harvesting.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. This method can be used for defense evasion by leveraging a trusted system utility (PowerShell) and a legitimate WMI class to install software, potentially bypassing traditional application whitelisting or execution policies.
Detects the deletion of Windows Volume Shadow Copies using PowerShell with WMI (Get-WmiObject/Get-CimInstance) or CIM (Remove-WmiObject/Remove-CimInstance) commands. This technique is commonly employed by ransomware families like Sodinokibi/REvil to prevent system recovery.
Detects PowerShell commands or scripts that attempt to disable the command history by removing the 'psreadline' module. This action is often performed by adversaries to evade detection and hinder forensic analysis by preventing their commands from being logged.
Detects the usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" with the '-Online' parameter to enable specific Windows optional features. This cmdlet is similar to DISM.exe and can be used to enumerate, install, uninstall, configure, and update features and packages in Windows images. The rule specifically looks for the enabling of potentially suspicious features like Telnet Server, Internet Explorer, TFTP Client, SMB1 Protocol, Client-ProjFS, and Microsoft-Windows-Subsystem-Linux.
Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.
Detects the use of obfuscated PowerShell commands that leverage STDIN for execution, often associated with tools like Invoke-Obfuscation. The rule specifically looks for patterns where 'cmd' is used to launch PowerShell with input redirection or the 'noexit' parameter, combined with a reference to 'input' or 'noexit' within the script block text.
This rule detects PowerShell script blocks that contain keywords associated with collecting local email data, specifically targeting Microsoft Outlook. It looks for script names like 'Get-Inbox.ps1' or the use of Outlook COM objects ('Microsoft.Office.Interop.Outlook', 'Microsoft.Office.Interop.Outlook.olDefaultFolders', '-comobject outlook.application'). This activity is indicative of an adversary attempting to gather sensitive information from a user's local email client.
Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.
Detects attempts to disable or modify Microsoft Defender features using PowerShell commands, specifically targeting various scanning and monitoring capabilities. The rule looks for `Add-MpPreference` or `Set-MpPreference` cmdlets combined with parameters like `DisableArchiveScanning`, `DisableRealtimeMonitoring`, `DisableIOAVProtection`, `DisableBehaviorMonitoring`, `DisableBlockAtFirstSeen`, `DisableCatchupFullScan`, or `DisableCatchupQuickScan` set to `$true` or `1`. It also includes detection for base64 encoded versions of these commands.
Detects the usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dll" DLL. This DLL is often used by attackers to perform Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) are not installed or administrative privileges are not available.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
This rule detects the execution of the PowerShell cmdlet 'Invoke-Command' with the '-ComputerName' parameter. This combination indicates an attempt to execute commands on a remote host using Windows Remote Management (WinRM). Adversaries commonly use this technique for lateral movement within a network after gaining valid credentials.
Detects obfuscated PowerShell execution leveraging `clip.exe` to retrieve commands from the clipboard. This technique is often used for defense evasion to hide malicious scripts.
This rule detects the creation of a new PowerShell remote session using the 'New-PSSession' cmdlet, specifically when targeting a remote computer via the '-ComputerName' parameter. This activity can be indicative of an adversary establishing remote access or moving laterally within a network.
Page 81 of 91