Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the execution of a PowerShell script that utilizes the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This combination is a strong indicator of potential data exfiltration via email, where an adversary might be sending sensitive files as attachments through SMTP. The rule aims to identify attempts to steal data by exfiltrating it over an unencrypted network protocol, specifically SMTP, to an alternative network location.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.
Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
Detects the execution of the 'msxsl.exe' utility with an 'http' keyword in the command line, indicating a potential attempt to execute XSL files from a remote source. This technique can be used by adversaries to bypass application control and execute malicious scripts.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. The rule specifically looks for child processes with suspicious image names (e.g., calc.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe), PowerShell or command prompt processes executing suspicious commands (e.g., Invoke-Expressions, IEX, Invoke-Command, DownloadString, rundll32, regsvr32, wscript, cscript), or child processes launched from suspicious paths (e.g., C:\Users\Public\, C:\Windows\Temp\, C:\Temp\).
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.
This rule detects the execution of BloodHound and SharpHound, which are reconnaissance tools used to map Active Directory environments. It identifies these tools by their product name, description, company name, executable image names, and specific command-line arguments often used for data collection, such as 'CollectionMethod All', '--Loop', '--PortScanTimeout', '-JsonFolder', '-ZipFileName', 'DCOnly', and '--NoSaveCache', as well as PowerShell cmdlets like 'Invoke-Bloodhound' and 'Get-BloodHoundData'.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
This rule detects PowerShell script block text that attempts to modify file timestamps (creation, last write, or last access times). This technique, known as timestomping, is often used by adversaries to hide new or modified files by making them appear to have older timestamps, blending them with legitimate files on the system.
Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.
This rule detects the execution of the PowerShell cmdlet 'Enable-PSRemoting'. This cmdlet configures the computer to receive PowerShell remote commands, which adversaries may use for lateral movement and remote execution. Detection relies on Script Block Logging being enabled to capture the cmdlet's execution.
This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious PowerShell execution. This includes attempts to execute base64 encoded commands, use of `IEX` (Invoke-Expression) with hidden windows and `New-Object`, execution of encoded commands, and use of `WebClient` to download and execute content.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.
Page 180 of 191