Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicating the use of Base64 encoded commands. Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by signature-based methods and to evade basic command-line logging. This detection specifically looks for the '-EncodedCommand', '-enc', or '-ec' flags (and their variations in casing) which are used to execute Base64 encoded strings as PowerShell commands.
Detects the execution of a PowerShell one-liner with obfuscation techniques characteristic of the MIMICRAT ClickFix campaign. This campaign tricks users into pasting a command that uses string manipulation and arithmetic to reconstruct and execute a malicious payload.
Detects PowerShell script content consistent with ETW disable (EventProvider.m_enabled) and AMSI bypass (AmsiUtils.amsiInitFailed) described in the MIMICRAT ClickFix chain.
Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.
Detects PowerShell execution with Unrestricted execution policy combined with suspicious flags or uncommon script extensions.
Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.
Detects PowerShell one-liners using Invoke-RestMethod (irm) or Invoke-WebRequest (iwr) piped to Invoke-Expression (iex) to download and execute the TrustConnect or DocConnect RAT.
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects a combination of suspicious registry persistence under the Microsoft TIP AggregateResults key and PowerShell launched with ExecutionPolicy Unrestricted referencing LunarApplication. Based on publicly described artefacts and intended for tuning and validation.
Detects the use of a specific PowerShell command pattern using the '[adsiSearcher]' type accelerator to enumerate and count computer objects in Active Directory. This technique was observed being used for discovery in campaigns following the exploitation of CVE-2026-1731 (BeyondTrust).
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
This detection identifies a pattern associated with the 'ClickFix' social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
Page 113 of 160