Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
Detects the initialization sequence of the Millenium RAT, which attempts to weaken host security by adding the entire C:\ drive as an exclusion path for Windows Defender using the Add-MpPreference PowerShell cmdlet.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, such as modifying AmsiUtils, AmsiScanBuffer, or related reflection-based obfuscation in process command lines.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects instances of PowerShell being launched directly by explorer.exe. This activity is a known indicator of 'ClickFix' or similar social engineering campaigns, where users are instructed by a deceptive website or lure to copy and paste malicious PowerShell commands into the Windows Run dialog or the File Explorer address bar to execute code.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
Detects a logon task or Run value that starts PowerShell with a network retrieval expression rather than a local administrative script. This rule specifically looks for modifications to registry run keys that include PowerShell or pwsh commands attempting to download content using methods like Invoke-WebRequest, DownloadString, DownloadFile, Net.WebClient, or curl.
Detects execution of a Brazilian invoice-themed batch file that launches hidden PowerShell and stages the banking trojan. This rule specifically looks for process creation events where the executable is 'cmd.exe' or 'powershell.exe' and the command line contains 'Consultar_NF-e.bat' or similar variations, indicating the use of a batch file named after a Brazilian invoice.
Identifies instances where a user account established an interactive logon session from a known RedVDS IP address and subsequently executed PowerShell commands containing download patterns (Net.WebClient or DownloadString), indicative of secondary payload retrieval.
Page 86 of 160