Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet to enumerate local group memberships, specifically looking for common administrative or privileged groups. This activity is often performed by attackers during the discovery phase to identify potential privilege escalation paths or valuable targets.
Detects non-interactive PowerShell activity by identifying PowerShell processes (powershell.exe or pwsh.exe) that are not spawned by typical user-facing graphical interface processes such as explorer.exe. This rule aims to identify PowerShell execution that is not directly initiated by a user through interactive means, potentially indicating automated or malicious activity. It includes filters for known legitimate parent processes like those associated with Windows updates, VS Code, and Windows Terminal to reduce false positives.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.
Detects suspicious invocation of the Get-ADDBAccount PowerShell script that reads from an ntds.dit file. This technique can be used to gain access to credentials without relying on traditional credential dumping tools. The rule specifically looks for the presence of 'Get-ADDBAccount', 'BootKey', and 'DatabasePath' in the PowerShell payload, indicating an attempt to extract credentials from an NTDS database file.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.
Detects obfuscated PowerShell code being executed via standard input (stdin) within PowerShell module logs. This technique is often used by adversaries to evade detection by security products that monitor for suspicious commands or scripts.
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
Detects highly obfuscated PowerShell commands using the VAR++ LAUNCHER technique, often associated with Invoke-Obfuscation. This method involves using `&&set` and specific character patterns like `(\{\d\}){2,}\"` combined with `-f` and `cmd /c` to evade detection.
Detects the use of specific strings or NULL bits within PowerShell scripts that are commonly employed to bypass Antimalware Scan Interface (AMSI) functionalities. This technique aims to prevent security products from inspecting malicious script content.
This rule detects potential data exfiltration attempts using PowerShell by identifying scripts that manipulate binary data into audio file formats, specifically WAV. It looks for PowerShell script block text containing mathematical operations, file I/O mode definitions, and the use of BinaryWriter, combined with specific byte sequences indicative of a WAV file header. This technique can be used to encode arbitrary data into an audio file for covert exfiltration.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects the usage of the "Add-AppxPackage" or its alias "Add-AppPackage" with the "-AllowUnsigned" flag to install unsigned AppX packages. This can be used by adversaries for persistence or defense evasion by installing malicious applications that bypass signature checks.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocations generated by the Invoke-Obfuscation framework. The rule specifically looks for patterns used by Invoke-Obfuscation to construct the 'IEX' string using character manipulation from PowerShell built-in variables like $PSHome, $ShellId, $env:Public, and $env:ComSpec, as well as other obfuscation techniques like `*mdr*).Name` and `$VerbosePreference.ToString(`.
Detects obfuscated PowerShell execution using environment variables, specifically looking for patterns indicative of Invoke-Obfuscation's VAR+ launcher. This technique involves setting environment variables with parts of a command and then reconstructing and executing it, often to evade detection.
This rule detects obfuscated PowerShell execution launched via rundll32.exe. It specifically looks for PowerShell script block text containing 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell', which are indicators of the Invoke-Obfuscation framework's RUNDLL LAUNCHER technique. This method is often used for defense evasion and execution of malicious scripts.
Detects obfuscated PowerShell scripts that utilize rundll32.exe, shell32.dll, and shellexec_rundll to execute commands. The rule specifically looks for the presence of '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll' along with keywords like 'value', 'invoke', 'comspec', or 'iex' within PowerShell script block logs. This combination is indicative of techniques used for defense evasion and execution.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
Page 85 of 91