Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,443
11,831
5,875
5,151
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,512
2,391
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell commands using '[scriptblock]::Create' in conjunction with character array decoding or large negative integer-array patterns. This technique is commonly used to deobfuscate and execute obfuscated PowerShell scripts at runtime.
Detects the execution of PowerShell commands using '[scriptblock]::Create' in conjunction with character array decoding or large negative integer-array patterns. This technique is commonly used to deobfuscate and execute obfuscated PowerShell scripts at runtime.
Detects the use of PowerShell with a hidden window ('-w hidden') to execute the 'Add-MpPreference' cmdlet to configure Windows Defender exclusions. This combination is often indicative of malicious activity, such as attempting to bypass security controls stealthily following a UAC bypass or initial access.
Detects suspicious execution patterns involving msiexec where a PowerShell process launches or is the parent of an MSI installation occurring from the %TEMP% directory with a GUID-based filename, or when msiexec executes an application from within %AppData%\Local\Programs. This pattern is often associated with fileless malware, ClickFix-style social engineering attacks, or suspicious persistence/installation behavior.
This rule detects the creation, modification, or renaming of files within specific sensitive directories under Local AppData (such as ComponentTask33, INetCache/FilterManager, or Shell/RemoteTempPrimary) that are closely timed with the execution of a PowerShell script named '*_scatter.ps1'. This behavior is indicative of potential malicious staging, data dropping, or modular deployment associated with a specific script-based attack chain.
This rule detects instances where PowerShell is executed by a Windows Script Host process (wscript.exe or cscript.exe) using common suspicious command-line arguments. This pattern is frequently used by adversaries to execute obfuscated or bypassed PowerShell scripts while attempting to hide or proxy the execution through legitimate scripting host processes.
Detects instances where PowerShell is initiated via LNK files, specifically targeting PDF LNK attachments or known malicious script naming patterns (update1.vbs, update2.ps1) and common downloader cmdlets (e.g., IEX, Invoke-WebRequest). It also includes specific indicators for remote file downloads.
Detects a multi-stage malware execution pattern consistent with VelvetCake activity. This includes staging text-based files in C:\Users\Public, downloading PowerShell scripts to temporary directories, executing the script via PowerShell, and subsequently deleting both the staged text files (except for specific allowed filenames) and the payload script.
Detects PowerShell ScriptBlock events (4104) that exhibit characteristics of AI/LLM-generated code, specifically the presence of highly descriptive inline commentary combined with encoded commands or remote network download cradles. This pattern is often used by automated tools to generate syntactically randomized obfuscated scripts to evade detection.
This rule detects interactive or user-triggered execution of PowerShell carrying indicators of payload downloading, inline evaluation, or Base64 encoding. Because explorer.exe is the parent process, it typically signifies a payload delivered via email/web that a user opened directly such as an .lnk shortcut.
This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.
This rule detects suspicious PowerShell activity associated with the Lightlife RAT, specifically targeting Google Chrome's login data files to steal credentials and performing checks for the presence of cryptocurrency wallets.
Detects the use of PowerShell to download the gitlab-runner-windows-amd64.exe binary from the official AWS S3 distribution bucket. This behavior is indicative of an attacker attempting to stage the GitLab Runner service to establish command and control or persistence within a compromised Windows environment.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) directly spawned by a GitLab Runner process. This behavior is associated with the abuse of GitLab CI/CD runners as a Command and Control (C2) mechanism to execute unauthorized commands on build infrastructure.
Detects anomalous GitLab CI pipeline execution that matches patterns associated with GitRunner C2 abuse. The detection identifies pipelines triggered via API (CI_PIPELINE_SOURCE=api) with cloning disabled (GIT_STRATEGY=none) and a specific static job name (run_command), which can indicate the CI runner is being abused as a command-and-control channel for arbitrary script execution.
Detects cmd.exe processes utilizing variable assignment and dynamic substring expansion to reconstruct and execute obfuscated PowerShell commands, a technique frequently observed in malicious LNK file decoy campaigns to evade static signature detection.
Detects the execution of PowerShell scripts containing a combination of Base64 encoding, compression (Deflate/Gzip), and UTF-32 decoding. This specific layering is commonly used to obfuscate malicious payloads and evade signature-based detection mechanisms in PowerShell environments.
This rule detects PowerShell script blocks containing a suspicious combination of Base64-like character sets and Cyrillic characters. This technique is often used in obfuscated payloads to evade static analysis signatures or to hinder human readability by inserting non-Latin characters within encoded content, which may trigger different parsing behaviors in various environments.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
Acronis reported a multilingual FileFix phishing site using anti-analysis techniques and advanced obfuscation, chaining into a Go-based loader with string encryption before deploying StealC.
Page 19 of 160