Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects PowerShell execution that combines 'irm' (Invoke-RestMethod) or 'Invoke-RestMethod' with 'iex' (Invoke-Expression) or 'Invoke-Expression'. This pattern is commonly used as a download cradle to fetch and execute malicious scripts or stage-2 infostealers, as observed in campaigns like the fake Gemini CLI installation script.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel to actively monitor user operations in real time and steal documents the moment they are modified.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel for real-time document surveillance to steal files the moment they are modified.
This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects PowerShell being executed with execution policy bypass and hidden window styles. This specific combination, particularly with the '-f' parameter, was utilized by the empty.vbs script to launch Profile.ps1 in the Dragon Weave campaign.
Detects PowerShell execution initiated by 'MicrosoftSystem64.exe' or 'MicrosoftSystem64' with specific command-line arguments (-NoProfile, -NonInteractive, -Command). This activity is indicative of the Node.js SEA RAT malware, associated with the DPRK-linked actor FAMOUS CHOLLIMA, attempting remote command execution.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects the execution of specific function names commonly associated with the WinPEAS PowerShell enumeration script, often used by adversaries to find privilege escalation paths.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.
Detects suspicious PowerShell execution chains (-nop, -w hidden, iex (gc) used in ClickFix RAT delivery.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Identifies PowerShell executing scripts or expressions from the ProgramData directory, which may indicate malicious staging or backdoor execution. This rule specifically looks for PowerShell processes where the command line includes 'C:\ProgramData\' and also contains keywords like 'IEX', 'Invoke-Expression', or '.ps1', suggesting the execution of a script or expression.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
Page 103 of 160