Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,350 detections
Filters
Last updated
All Time
Detection languages
1,337
1,010
315
199
184
Contributors
960
506
379
300
208
Categories
20,456
11,839
5,876
5,155
4,865
3,350
Platforms
3,335
17
14
12
7
Products / Services
1,535
807
640
457
291
MITRE Techniques
2,514
2,393
1,393
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Detects Explorer.exe spawning PowerShell to fetch a polymorphic server-side payload where the URL contains randomized alphanumeric parameters preventing static caching.
Identifies the execution of IEX (New-Object Net.WebClient).DownloadString directly from a run prompt, avoiding disk writes entirely. This rule specifically looks for PowerShell command-line activity where 'IEX' is used in conjunction with 'New-Object Net.WebClient).DownloadString', indicating an attempt to download and execute content directly in memory.
Correlates the ClickFix execution directly to the creation of the NetSupport RAT files (client32.exe) in public directories, specifically when PowerShell is used to access the clipboard.
Detects Windows Explorer executing an LNK file that directly spawns PowerShell to download the next-stage tax lure payload. This pattern is indicative of a phishing attack attempting to deliver malicious content.
Identifies PowerShell commands that generate a unique victim ID by hashing the concatenated ComputerName and UserName, a technique used by the InstallFix malware.
This rule detects instances where 'Invoke-WebRequest' (or its aliases 'IEX', 'IWR') is executed by 'powershell.exe' directly from 'explorer.exe'. This pattern is often indicative of a user launching a malicious PowerShell command from the Run dialog, clipboard, or a shortcut, rather than within a legitimate script context. This specific detection is linked to the ClickFix campaign, which uses information stealers.
Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.
Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
Detects rapid clipboard monitoring and substitution behavior via PowerShell APIs.
This YARA rule detects the presence of various PowerShell commands and functions that are commonly used in malicious scripts. It looks for a combination of specific cmdlets like 'New-Object', 'Invoke-WebRequest', 'Invoke-Expression', 'Set-ExecutionPolicy Bypass', and 'Add-Type', as well as patterns for functions that might be used for obfuscation or specific malicious activities (e.g., 'vS35wIDY9U', 'wEAXbwCuxi'). The rule triggers if at least three of the defined strings or regular expressions are found, indicating potential PowerShell-based malicious activity.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup. This technique was observed in a campaign deploying obfuscated batch scripts disguised as PNG files into the Startup folder.
Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).
This rule detects PowerShell execution that includes specific command-line arguments consistent with decoding XOR-encoded payloads. It looks for 'powershell.exe' processes where the command line contains '-bxor' and references to files like 'Profile.ps1', '1.dat', or 'Com.dat', which are associated with the Dragon Weave campaign's decoding activities.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects PowerShell launched with hidden or non-interactive options and encoded, compressed, or character-reassembled content. This behavior is often indicative of malicious activity, as adversaries use these techniques to evade detection and obscure their commands.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Page 99 of 160