Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
Detects PowerShell downloading and executing remote payloads using invoke-restmethod/irm and invoke-expression/iex. This technique is widely used by ClearFake and PS1Bot malvertising campaigns to execute in-memory payloads directly from C2 servers.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Detects highly obfuscated PowerShell command lines that utilize various encoding and execution techniques, often indicative of malicious activity. The rule scores different obfuscation methods (XOR, Hex, Base64), execution methods (ScriptBlock, IEX), and payload indicators (URLs, download functions). A high total score and specific thresholds for execution and obfuscation trigger the alert. It also considers suspicious parent processes like browsers or scripting hosts.
This rule detects the presence of Remcos RAT by looking for specific strings in memory or files. It identifies a complex PowerShell command used for downloading and executing a base64-encoded payload, which is characteristic of Remcos RAT's infection chain. Additionally, it looks for specific file paths and other PowerShell-related strings often associated with Remcos RAT activity.
Correlates execution of a .pdf.lnk shortcut spawning wscript to run the empty.vbs bridge, followed by a PowerShell process.
Detects PowerShell excluding targeted mining executables and RuntimeHost.exe from Microsoft Defender Antivirus scans. This activity is indicative of cryptojacking campaigns attempting to evade detection.
Detects PowerShell initiating web requests specifically for .jpeg files, a core component of the staging phase of the SilentCanvas operation.
This rule detects PowerShell processes executing 'Invoke-WebRequest' (IWR) or 'IEX' (Invoke-Expression) commands that establish network connections to the domain 'wigetticks.com'. This combination indicates potential adversary activity involving downloading and executing malicious content from a specific attacker-controlled infrastructure, as identified in the SmartApeSG campaign.
Detects the execution of 'reset.ps1' via PowerShell, which has been identified as the ChainShell deployer script. This activity is associated with the MuddyWater threat group.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects PowerShell iterating directories for known cryptocurrency wallet extensions and associated strings, indicative of PS1Bot malware activity attempting to harvest wallet data.
Page 100 of 160