Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects QoS policy creation with a throttle rate applied, targeting EDR disconnection via extreme low bandwidth. This rule specifically looks for PowerShell commands that include 'ThrottleRateActionBitsPerSecond' in their additional fields, indicating an attempt to set a very low bandwidth throttle.
Detects the creation of Quality of Service (QoS) policies via PowerShell that explicitly target known Endpoint Detection and Response (EDR) agent executables. This activity could indicate an adversary attempting to degrade or block EDR telemetry to evade detection.
Detects enumeration of existing QoS policies via PowerShell, potentially used by attackers to verify throttling. This rule specifically looks for the execution of the 'Get-NetQosPolicy' command within PowerShell.
Detects PowerShell commands that contain a reversed string pattern often used by Vidar malware to de-obfuscate its C2 endpoint at runtime. The specific pattern 'txt.[0-9a-zA-Z]+/selif_cilbup' is indicative of this technique.
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects wscript.exe spawning PowerShell with encoded command from C:\Temp.
Detects users copy-pasting PowerShell commands from fake 'system error' prompts.
Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects PowerShell executing base64 encoded payloads or the string "I am not a robot" typically associated with FakeCaptcha malware found in the clipboard. This rule specifically looks for these indicators within the process command line of PowerShell or pwsh processes.
Detects the execution of Invoke-SMBRemoting for fileless lateral movement, specifically looking for PowerShell processes with 'Invoke-SMBRemoting' in their command line.
Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects ClickFix payloads executing PowerShell with invoke-expression (iex) and invoke-restmethod (irm) to fetch remote payloads into memory without touching disk, as seen in DeepLoad delivery.
Detects disabling of PowerShell command history logging to impair forensics
Page 97 of 160