Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects a registry modification to the HKCU Run key that executes a PowerShell script located in the %TEMP% directory. This behavior is associated with the TuglaInsaatci steganographic .NET loader campaign, often used to drop commodity malware such as Remcos RAT.
Detects execution of PowerShell commands originating from a batch (.bat/.cmd) script that utilize .NET WebClient methods (DownloadString/DownloadFile) combined with process execution cmdlets (Start-Process/Invoke-Expression/IEX). This pattern is associated with the delivery and execution of the OXLOADER malware via BATPackageBuilderSetup.bat.
Identifies the threat actor executing PowerShell commands to add entire root directories (C:\) to Defender's exclusion list before dropping the ransomware payload.
Hunts for PowerShell scripts natively importing cryptographic classes (AesManaged, CryptoStream) to decrypt secondary payloads directly in memory.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
Detects the loader interrogating the process list for a specific cluster of sandbox/analysis tools before proceeding with the infection. This rule specifically looks for PowerShell executing and its command line containing at least two of the listed sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview).
Detects the creation or modification of a Registry Run key to establish persistence using PowerShell with specific obfuscation techniques. The rule looks for PowerShell commands that include '-NoProfile', '-ExecutionPolicy Bypass', '-WindowStyle Hidden', and '-File', and also references a temporary directory ('AppData\\Local\\Temp'). This combination is often used by adversaries to execute malicious scripts discreetly upon user logon.
Detects the creation or modification of a Registry Run key that executes PowerShell with specific parameters indicating a hidden window, no profile, bypass execution policy, and referencing a script in the AppData\Local\Temp directory. This is a common technique used by adversaries for persistence and to evade detection.
Detects PowerShell execution attempting to interact with AppX packages using 'DiscCoerceProbe'. This activity is often associated with privilege escalation or system manipulation techniques.
Detects PowerShell execution with '-ExecutionPolicy Bypass -File' arguments, combined with specific suspicious file paths or command-line strings often associated with privilege escalation or malicious activity. It also looks for suspicious AppX package management commands.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
This rule detects initial access attempts involving double-extension shortcuts (.lnk) that lead to the execution of VBScript (VBS) files, which subsequently launch PowerShell scripts for decryption. The detection logic specifically looks for a .lnk file executing a command line containing '.vbs', followed within 5 minutes by a PowerShell process executing a command line containing 'Profile.ps1' or '-bxor'. This chain of events is indicative of malicious activity often used in phishing campaigns to bypass security controls and execute obfuscated payloads.
Detects PowerShell downloading a packed loader DLL and writing it directly to the C:\Users\Public directory. This rule specifically looks for file creation events where the file path is within 'C:\Users\Public', the file name ends with '.dll', and the initiating process is 'powershell.exe'.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Page 95 of 160