Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
315
198
184
Contributors
960
506
379
300
208
Categories
20,443
11,831
5,875
5,151
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
640
457
291
MITRE Techniques
2,512
2,391
1,391
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell with obfuscation-related flags (-NoProfile, -WindowStyle Hidden, -EncodedCommand) initiated by common scripting interpreters (wscript.exe, mshta.exe, cscript.exe). This pattern is often indicative of malicious scripts, such as HTA or VBScript files, attempting to execute encoded PowerShell commands in a high-privilege context.
Detects attempts to disable PowerShell Script Block Logging via registry modification or by using the Set-ItemProperty command. Disabling this security feature prevents visibility into the actual contents of executed PowerShell scripts, which is a common tactic used by adversaries to evade detection.
Detects attempts to disable PowerShell Script Block Logging via registry modification or by using the Set-ItemProperty command. Disabling this security feature prevents visibility into the actual contents of executed PowerShell scripts, which is a common tactic used by adversaries to evade detection.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
Detects execution of GitLab Runner registration commands via PowerShell Script Block Logging (EID 4104). This rule identifies potentially sensitive configuration parameters, such as registration tokens or executor configurations, being passed in cleartext during the enrollment process.
Detects anomalous PowerShell script execution originating from GitLab CI runners where the environment variables suggest unauthorized command execution, specifically identifying usage of 'IEX' to execute commands passed via the 'CMD' environment variable, often used in GitRunner C2 techniques.
Detects the use of PowerShell to download a file named Document.pdf using Invoke-WebRequest, saving it to disk, and immediately executing it using Start-Process. This behavior is indicative of a dropper or secondary stage payload execution pattern.
Detects the use of PowerShell to delete files with common script or shortcut extensions from directories frequently used for persistence or staging malicious payloads, such as APPDATA, ProgramData, and the Startup folder.
This rule detects potential screen capture activity performed by either a suspicious executable (SearchTrustedRuntimeSvc.exe) that mimics a screen capture tool or a PowerShell script invoked by Node.js using .NET drawing libraries. This behavior is indicative of unauthorized information gathering, common in remote access trojans (RATs).
This rule detects suspicious PowerShell execution initiated by a Node.js process (node.exe). It monitors for command lines containing common bypass flags (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) and a specific string pattern 'wra-ps-', which is often associated with malicious scripts or remote access trojans (RATs) being executed via a Node.js application.
Detects the use of PowerShell to load .NET assemblies into memory using System.Reflection.Assembly::Load combined with indicators often associated with fileless payload execution, such as GZip decompression, AES decryption, or method invocation (EntryPoint.Invoke, GetType).
Detects the execution of PowerShell commands that utilize .NET cryptography classes (AesManaged) in conjunction with data compression (GZipStream) and base64 decoding (FromBase64String). This combination of classes is highly characteristic of malicious scripts designed to decrypt and execute obfuscated or packed payloads in memory.
Detects the execution of PowerShell with suspicious command-line arguments (headless mode, hidden window, encoded commands) spawned by WScript.exe. This pattern is commonly associated with obfuscated script execution or fileless malware staging.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
Page 22 of 160