Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
This rule detects the execution of the PowerShell cmdlet 'Get-GPO'. This cmdlet is used to retrieve information about Group Policy Objects (GPOs) in a domain. Adversaries may use this for discovery purposes to understand the domain's policy configurations, which can aid in identifying potential privilege escalation paths or misconfigurations.
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects PowerShell scripts that utilize the "Compress-Archive" cmdlet to compress folders and files, storing the output in common temporary directories often used by adversaries for data staging prior to exfiltration. This behavior is indicative of an adversary preparing collected data for exfiltration by archiving it to minimize size and make it portable.
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
Detects keywords within PowerShell module logs that indicate an attempt to clear PowerShell history. This includes commands like 'Remove-Item' or 'del' targeting the history file path, or 'Set-PSReadlineOption' to disable history saving.
Detects the creation of a PowerShell module where the module contents specifically include "function Get-VMRemoteFXPhysicalVideoAdapter". This pattern is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. An attacker might use this technique to execute arbitrary code by tricking the legitimate signed binary into loading a malicious PowerShell module.
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
This rule detects PowerShell script execution that attempts to enumerate installed software on a Windows system. Specifically, it looks for the combination of `Get-ItemProperty`, `\software\`, `Select-Object`, and `Format-Table` within the PowerShell script block text. This pattern is commonly used to query the registry for installed applications under `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\` and format the output.
This rule detects PowerShell commands that attempt to store data in an Alternate Data Stream (ADS) by redirecting the output of a command executed via `cmd.exe` (comspec) into a file using the `>` operator. This technique is often used by malware, such as Astaroth, to hide malicious data within legitimate files, making it harder to detect.
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.
This rule detects PowerShell scripts attempting to open a handle to a drive volume using the `IO.FileStream` object and the `\\.\` DOS device path specifier. This technique is often used for direct access to the volume, bypassing standard file system controls.
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
This rule detects the use of 'X509Enrollment' objects within PowerShell scripts. Adversaries may use X509Enrollment to install root certificates, which can be leveraged to bypass security warnings when connecting to adversary-controlled web servers or to sign malicious code, thereby subverting trust controls and enabling defense evasion.
Page 82 of 91