Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,907 detections
Filters
Last updated
All Time
Detection languages
719
486
238
182
142
Contributors
547
475
198
184
152
Categories
1,535
958
955
583
128
Platforms
1,890
19
10
7
5
Products / Services
10,665
9,773
6,705
4,421
3,749
1,907
MITRE Techniques
1,254
1,146
731
283
260
CVEs
7
3
2
2
2
IDS Classtypes
1
IDS Protocols
1
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Detects the use of the PowerShell 'Write-EventLog' cmdlet in conjunction with the '-RawData' flag. This combination can be exploited by adversaries to embed malicious payloads within Windows Event Logs, which can then be retrieved later. This technique is often employed for defense evasion, allowing attackers to conceal their activities within seemingly legitimate system logs. Detection relies on PowerShell Script Block Logging being enabled.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.
This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.
Detects the usage of COM objects within PowerShell commands that can be leveraged to download files. This rule specifically looks for the `[Type]::GetTypeFromCLSID(` method combined with known Class IDs (CLSIDs) associated with objects capable of file downloads.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
Detects the use of PowerShell cmdlets 'Add-AppxPackage' or 'Add-AppPackage' with the '-AllowUnsigned' flag to install unsigned AppX packages. This activity can be indicative of an adversary attempting to establish persistence or evade defenses by installing malicious applications that are not signed by a trusted authority.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.
Detects obfuscated use of stdin to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule specifically looks for patterns in PowerShell module logs (Event ID 4103) where 'cmd' is used with '/c' or '/r' to launch PowerShell, incorporating input from stdin (e.g., using ${input} or noexit).
This rule detects the execution of the PowerShell cmdlet `Disable-WindowsOptionalFeature` with specific parameters, indicating an attempt to disable Windows optional features. The rule specifically looks for the `-Online` and `-FeatureName` parameters, and then checks for common Windows Defender related feature names. This activity could be part of an adversary's defense evasion tactics to impair security tools.
Detects attempts to change the PowerShell script execution policy to a less secure level (Unrestricted or Bypass) using the `Set-ExecutionPolicy` cmdlet. This action can allow unsigned or untrusted scripts to run, increasing the risk of malicious code execution.
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
This rule detects potential PowerShell obfuscation techniques where the '-join' operator is used within the '-Value' parameter of 'Set-Alias' or 'New-Alias' cmdlets. This method is often employed by adversaries to hide the true command or object being aliased, making it harder to analyze the script's intent. The rule specifically looks for the combination of '-Alias' and ' -Value (-join(' within PowerShell script block text.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
This rule detects the use of WMImplant, a PowerShell-based post-exploitation tool that leverages Windows Management Instrumentation (WMI) for various malicious activities. It specifically looks for keywords and function names associated with WMImplant's capabilities within PowerShell script block logs, such as 'WMImplant', 'change_user', 'command_exec', 'disable_wdigest', 'enable_winrm', 'registry_mod', 'remote_posh', 'sched_job', 'service_mod', 'process_kill', 'active_users', 'basic_info', 'power_off', 'vacant_system', and 'logon_events'. Detection requires PowerShell Script Block Logging to be enabled.
Detects PowerShell command-line obfuscation techniques specifically associated with 'COMPRESS OBFUSCATION' often used by tools like Invoke-Obfuscation. This method typically involves compressing data and decompressing it in memory using .NET classes like `System.IO.Compression.DeflateStream` and `System.IO.StreamReader` combined with `new-object` and `text.encoding]::ascii`.
Detects keywords from well-known PowerShell exploitation frameworks
Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell
PowerShell PSAttack
Sigma
Detects the use of PSAttack PowerShell hack tool
Page 86 of 91