Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects execution of PowerShell or PowerShell ISE containing indicators associated with 'Ptero' malware families or known file-hosting services and infrastructure used for payload delivery or command-and-control. The rule specifically monitors for suspicious command-line strings and flags executions triggered by common persistence or infection vectors like Word documents, WMI, or scripting engines.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing backups.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects the GitLab Runner process (gitlab-runner-windows-amd64.exe) spawning PowerShell with command-line arguments indicative of a C2 framework or manual operator interaction, such as '-NoProfile', '-NonInteractive', '-ExecutionPolicy Bypass', and '-Command'. The rule specifically targets instances where these processes are executed under the SYSTEM account, a behavior commonly associated with exploiting CI/CD runners for persistent command execution.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
This rule detects attempts to disable PowerShell history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle' set to 'SaveNothing'. This technique can be used by adversaries to hinder forensic analysis and hide their command execution history.
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' (Invoke-RestMethod) fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex' (Invoke-Expression). This pattern is indicative of the GLASSWORM malware's initial payload delivery mechanism.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the use of PowerShell commands that leverage 'Invoke-Expression' (IEX) in conjunction with 'Net.WebClient' or 'DownloadString' methods to download and execute code directly from the internet into memory.
Hunts for PowerShell commands setting up the RijndaelManaged API in ECB mode, a cryptographic pattern used by AsyncRAT for C2 packet encryption.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. These activities include PowerShell registry queries and process listing commands, indicative of potential malicious behavior.
Detects attempts to register an AppxPackage from a UNC path using PowerShell, which is a prerequisite for the UnCanny LPE/Coercion attack. This technique leverages the Add-AppxPackage cmdlet with the -Register parameter and a UNC path.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Page 85 of 160