Niclas Gustafsson
@NiclasCompletionist
0 followers0 downloads20 copies0 likes201 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
Detects PowerShell processes executing commands that combine `Invoke-Expression` (iex) and `Invoke-RestMethod` (irm) with an HTTP or HTTPS URL. This combination is often used by adversaries to download and execute malicious scripts or payloads directly from the internet, without writing them to disk. The rule includes exclusions for known legitimate installers like the UV installer launched by trusted processes.
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.