Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell commands attempting to query the Terminal Services Remote Connection Manager event log for Event ID 1149. This may indicate adversary reconnaissance of RDP connection history to identify targets for lateral movement.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Powershell use PassThru option to start in background
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects PowerShell processes executing commands that include base64 decoding (FromBase64String), invoking expressions (IEX), creating web client objects (New-Object Net.WebClient), and making HTTP/HTTPS requests. This combination is often indicative of malicious PowerShell activity, such as downloading and executing payloads from remote servers, potentially obfuscated.
Detects the use of the Add-MpPreference cmdlet to add the root C:\ drive to the Windows Defender exclusion path. Attackers and ransomware families, such as The Gentlemen, use this technique to completely blind Windows Defender to malicious file activity during the encryption process.
This rule detects the execution of PowerShell with encoded commands. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for 'powershell.exe' in the process filename and either '-enc' or '-encodedcommand' in the command line, while excluding known legitimate uses by 'Windows Defender'.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
Detects the use of the Enable-WindowsOptionalFeature cmdlet to reactivate the deprecated and vulnerable SMB1Protocol. Attackers use this to facilitate lateral movement to legacy systems.
This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.
Detects the execution of PowerShell that has been renamed to 'wt.exe', matching the Axios RAT Windows payload behavior. This rule identifies processes masquerading as Windows Terminal (wt.exe) but whose underlying executable is actually PowerShell.
Detects the execution of the Set-MpPreference PowerShell cmdlet to disable Windows Defender real-time monitoring. This technique is frequently abused by malware and ransomware affiliates, such as The Gentlemen RaaS, to bypass endpoint defenses prior to payload detonation.
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
Page 105 of 160