Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Faux Elevate Uac Bypass
YARA-L
This rule detects a Faux-Elevate UAC bypass technique. It correlates the launch of auto-elevated processes like 'fodhelper.exe' or 'eventvwr.exe' with the subsequent spawning of suspicious child processes such as 'powershell.exe', 'cmd.exe', or 'wscript.exe'. The detection is further refined by looking for malicious PowerShell patterns within the command line of these child processes, specifically keywords like 'IEX', 'DownloadString', 'Invoke-WebRequest', or '-enc'. Additionally, the rule identifies registry modifications targeting keys related to 'ms-settings\shell\open\command', which is indicative of a registry hijack often used in UAC bypasses.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
Detects PowerShell commands attempting to retrieve the installed UI culture name. This specific technique is utilized by the EtherRAT SYS_INFO module to check the system's locale and selectively self-destruct on CIS-region machines.
Detects the Faux-Elevate UAC bypass technique where auto-elevated binaries (fodhelper.exe, eventvwr.exe) are abused to launch suspicious child processes like PowerShell or cmd.exe. The detection logic further correlates this with registry modifications related to UAC bypass (specifically 'Software\Classes\ms-settings\shell\open\command') and subsequent outbound network activity to retrieve payloads, indicating a full chain of execution and C2 communication.
Detects PowerShell processes executing commands that combine `Invoke-Expression` (iex) and `Invoke-RestMethod` (irm) with an HTTP or HTTPS URL. This combination is often used by adversaries to download and execute malicious scripts or payloads directly from the internet, without writing them to disk. The rule includes exclusions for known legitimate installers like the UV installer launched by trusted processes.
Detects PowerShell script blocks loading the WinRT ToastNotificationManager API or using the ContentType=WindowsRuntime type accelerator syntax. Used by attackers to programmatically send fake toast notifications impersonating legitimate applications such as Microsoft Edge, Teams, or Windows Security.
Detects PowerShell script blocks containing the scenario="incomingCall" XML attribute, which triggers Windows' special incoming call notification UI with accept/dismiss buttons and an avatar image loaded from an attacker-controlled URL. Sourced from the toastnotify-bof repository incoming-call.xml example payload. Near-zero legitimate enterprise use of this attribute in PowerShell.
Detects PowerShell constructing toast notification XML with an external HTTP image URL alongside WinRT toast API calls. When the notification is displayed the notification platform fetches the image, creating an outbound connection to an attacker-controlled server for delivery confirmation. Sourced from the toastnotify-bof repository incoming-call.xml and teams-security-alert.xml example payloads.
Detects Invoke-CredentialPhisher (legacy tool) or the sendtoast keyword in PowerShell script blocks. Both are direct indicators of an active toast notification-based credential phishing operation in progress.
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects PowerShell constructing toast notification XML containing an activationType attribute combined with a protocol scheme. This pattern creates a clickable notification button that launches a URI handler, the primary mechanism for delivering phishing links via toast notifications. Covers both msteams:// protocol links and generic protocol handlers.
Detects PowerShell enumerating Application User Model IDs via the notification settings registry hive, the Get-StartApps cmdlet, or the System.AppUserModel.ID extended property on .lnk shortcuts. Attackers use these to discover trusted AUMIDs to impersonate in fake toast notifications.
Detects the creation of a scheduled task named "Recovery Diagnostics" that executes PowerShell scripts from the C:\Users\Public directory. This specific technique has been observed being used by threat actors as a persistence and execution mechanism during INC ransomware staging to trigger base64-encoded PowerShell payloads for data exfiltration.
Detects the execution of PowerShell or VBScript scripts matching the naming conventions "Romeo*.ps1" or "Juliet*.vbs". These scripts are utilized as initial triggers for a stealthy Deno-based in-memory loader, a technique recently observed in LeakNet ransomware campaigns following initial access.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects suspicious PowerShell execution patterns commonly associated with the ClickFix initial access technique, where a user is tricked into pasting and executing a malicious script.
Detects the C2 communication of the Slopoly PowerShell backdoor, used by the Hive0163 group. It looks for specific HTTP POST requests containing a JSON body with characteristic keys.
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
Page 110 of 160