Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,346 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,439
11,829
5,873
5,151
4,864
3,346
Platforms
3,331
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,511
2,390
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell processes using suspicious command-line flags, encoding, or built-in .NET network download methods (e.g., IEX, Net.WebClient, DownloadString). The rule excludes signed PowerShell binaries and common system management tools like SCCM or monitoring agents to reduce false positives.
Detects the use of PowerShell to modify Windows Defender settings (e.g., disabling real-time monitoring, adding exclusions, or stopping services) using the Set-MpPreference cmdlet or service control commands. This technique is frequently utilized by ransomware actors, such as the ALPHV/BlackCat group, to neutralize security protections prior to executing malicious payloads.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the use of PowerShell Set-MpPreference commands to disable multiple Microsoft Defender security features, including real-time monitoring, behavioral scanning, and threat detection actions. This activity is consistent with ransomware behavior, such as Nova or The Gentlemen families, attempting to neutralize endpoint protection before proceeding with malicious actions like file encryption.
Detects the use of PowerShell to modify Microsoft Defender exclusion paths by adding root drive letters or temporary directory paths. This behavior is indicative of defense evasion techniques often employed by ransomware families, such as Nova or Gentlemen, to prevent the scanning of files immediately prior to encryption.
Detects attempts to terminate security-related processes (AV/EDR) using common administrative tools including taskkill.exe, wmic.exe, and PowerShell Stop-Process. This behavior is frequently observed during the pre-encryption phase of ransomware attacks, such as Nova and Gentlemen, to evade detection.
Detects attempts to terminate security-related processes (AV/EDR) using common administrative tools including taskkill.exe, wmic.exe, and PowerShell Stop-Process. This behavior is frequently observed during the pre-encryption phase of ransomware attacks, such as Nova and Gentlemen, to evade detection.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
Detects a specific social-engineering pattern known as 'ClickFix' where a user is manipulated into opening the Windows Run dialog (explorer.exe) to manually execute commands. The rule identifies suspicious command-line arguments typically associated with initial access (e.g., PowerShell hidden/encoded execution, web downloads) followed by the execution of MSI installers or related malicious binaries (e.g., rnpkeys.exe) within a 30-minute window, indicative of the Sauron Loader infection chain.
Detects the use of PowerShell or Windows Script Host to access files within common web browser cache directories combined with indicators of Base64 decoding and pixel data manipulation. This behavior is indicative of extracting malicious payloads hidden via steganography within browser-cached image files, a technique often used in phishing campaigns to evade detection.
Detects the Exvicy 'ClickFix' campaign execution chain where explorer.exe spawns a PowerShell process utilizing download commands (e.g., Invoke-WebRequest, Invoke-RestMethod) to interact with known malicious domains or IP addresses, followed by the execution of installers (msiexec.exe) or tools (putty.exe) within a short timeframe.
Detects multiple reconnaissance commands executed by PowerShell processes running as the SYSTEM account. This behavior is indicative of an attacker attempting to enumerate domain trusts, group memberships, or user sessions on a host to facilitate lateral movement or privilege escalation.
Detects the execution of PowerShell or PowerShell Core (pwsh) triggered by common Windows shell applications (explorer, mshta, wscript, cscript) where the command line contains indicators associated with the downloading of VelvetCake stager files, including specific GitHub raw content URLs or AppData paths referencing known stager filenames.
Detects the VelvetCake malware installation and operational pattern, which utilizes a scheduled task named 'OneDriveUpdateScheduler' to execute PowerShell scripts ('update1.ps1' or 'update2.ps1'). These scripts periodically retrieve modules or payloads from external infrastructure, specifically hardcoded C2 IPs or a dedicated GitHub repository.
This rule detects the suspicious combination of PowerShell scripts executing download commands (Invoke-WebRequest, etc.) while initiated by scripting hosts (wscript.exe, cscript.exe), followed by activity associated with remote support tools (LogMeIn, ConnectWise, etc.). It also identifies network connections associated with these remote management platforms, suggesting potential unauthorized remote access or tool staging.
Detects the execution of PowerShell with hidden window styles and encoded commands, initiated with High Integrity (Admin) privileges. This pattern is often indicative of bypasses for User Account Control (UAC) or malicious script execution where an adversary attempts to run elevated code while minimizing user visibility.
Detects the creation of a scheduled task intended to masquerade as 'MicrosoftEdgeUpdateTask' using either schtasks.exe or PowerShell. The rule specifically monitors for tasks being registered in AppData/Roaming directories, which is a common indicator of persistence by malicious actors attempting to mimic legitimate Microsoft Edge update processes.
Detects the creation of a scheduled task intended to masquerade as 'MicrosoftEdgeUpdateTask' using either schtasks.exe or PowerShell. The rule specifically monitors for tasks being registered in AppData/Roaming directories, which is a common indicator of persistence by malicious actors attempting to mimic legitimate Microsoft Edge update processes.
Page 11 of 160