Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects PowerShell or .NET code modifying ServicePointManager or certificate validation callbacks so later downloads accept untrusted certificates. This behavior is often associated with malware like InstallFix to bypass security measures during C2 communication or payload delivery.
Detects a script constructing a URL or request path from hostname, username, machine GUID, or volume serial information before downloading a second stage. This behavior is associated with the InstallFix malware.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
This rule detects PowerShell processes attempting to retrieve or execute content from a remote RTF (Rich Text Format) resource. It specifically looks for PowerShell commands like 'Invoke-WebRequest', 'iwr', 'DownloadString', 'Invoke-Expression', or 'iex' that are directed towards a URL ending with '.rtf'. This behavior is often associated with malicious activity where RTF files are used as a delivery mechanism for scripts.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects PowerShell invoking Add-Type to compile C# code inline, indicative of PS1Bot malware. Specifically looks for the use of 'Add-Type' in PowerShell command lines combined with specific C# methods like 'SetWindowsHookEx', 'Graphics', or 'CopyFromScreen', which are often used for screen capture or other malicious activities.
Detects execution of PowerShell with encoded commands, often used in malicious scripts.
Correlates the Get-Clipboard cmdlet execution natively invoked by the user shell, proving the "paste-to-run" ClickFix mechanism. This rule specifically looks for PowerShell execution of 'Get-Clipboard' where the initiating process is 'explorer.exe'.
Detects the execution of PowerShell with the '-WindowStyle Hidden' flag, specifically when initiated by 'explorer.exe', which is a known tactic used by the ClickFix malware to mask its payload execution.
Detects the polymorphic script's initial action: patching the AmsiScanBuffer to prevent Defender from catching the subsequent payload. This rule specifically looks for PowerShell commands containing 'amsiInitFailed' or 'AmsiScanBuffer', which are indicators of attempts to bypass AMSI.
Detects the secondary PowerShell payload establishing a persistent WebSocket connection to a randomly generated endpoint structure.
Detects the invocation of the 32-bit PowerShell executable (from SysWOW64) via cmd.exe with a Base64 encoded command, which can be used to bypass 64-bit hooks and execute malicious payloads.
Detects PowerShell utilizing [Runtime.InteropServices.Marshal]::WriteInt32 to overwrite the amsiContext memory space with 0x41414141, indicating an attempt to bypass AMSI.
Detects PowerShell commands that modify Quality of Service (QoS) policies targeting the 'ActiveStore'. This technique can be used by adversaries to apply throttling to processes, potentially bypassing EDR solutions without requiring a system reboot, as described in the EDRChoker playbook.
Page 96 of 160