Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,008 detections
Filters
Last updated
All Time
Detection languages
1,930
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,440
11,814
5,871
5,145
4,864
4,008
Platforms
3,584
660
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,296
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Detects the execution of PowerShell commands embedded within a link (.lnk) file. This rule specifically looks for instances where 'explorer.exe' launches 'cmd.exe', and the command line of 'cmd.exe' contains both 'powershell' and '.lnk', indicating an attempt to execute PowerShell via a shortcut file.
This rule detects a PowerShell downgrade attack where an adversary attempts to force PowerShell to use an older, less secure engine version (2.0) while the host system is configured for a newer version. This technique is often used to bypass security features like Script Block Logging which are present in newer PowerShell versions.
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects the execution of a PowerShell script known as POWERHOLD, which has been attributed to the FIN7 threat group. The rule specifically looks for the presence of '$env:APPDATA', 'function MainPayload', '::WriteAllBytes', and 'wscript.exe' within the PowerShell script block text, indicating the execution of this specific malicious script.
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. This behavior is often associated with malware or adversaries attempting to execute payloads from temporary or user-writable directories.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects PowerShell execution where the command line contains Base64 encoded strings that decode to 'Invoke-' keywords. It specifically looks for both UTF-8 and UTF-16 Little Endian (LE) encodings of 'Invoke-' when PowerShell or pwsh.exe is executed with the '-e' (encoded command) flag. This technique is commonly used by adversaries to obfuscate malicious PowerShell commands.
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. The detection relies on the presence of 'FromBase64String' for decoding, 'MemoryStream' for in-memory operations, and 'H4sI' which is a common magic string for Gzip compressed data.
Detects a specific PowerShell command line pattern used by the UNC2452 threat group (also known as APT29 or Nobelium) for execution. The rule looks for PowerShell commands that use 'Invoke-WMIMethod win32_process -name create -argumentlist' or 'wmic /node: process call create' in conjunction with 'rundll32 c:\windows'. This pattern was observed in the SolarWinds Compromise.
Detects process execution patterns associated with the Hermetic Wiper malware, specifically looking for a process named 'postgresql.exe' in a policydefinitions directory or specific command-line arguments used for credential dumping and logging.
This rule detects the potential execution of the POWERTRASH PowerShell script by looking for a specific combination of strings within the PowerShell script block text. These strings include .NET framework components related to compression (IO.Compression.DeflateStream), memory manipulation (IO.MemoryStream), base64 decoding (::FromBase64String), and reflection/code execution (GetDelegateForFunctionPointer, .Invoke(), GlobalAssemblyCache). The presence of these indicators together suggests a highly obfuscated or advanced PowerShell script, often used for malicious purposes like in-memory execution or bypassing detection.
This rule detects suspicious child processes spawned by the VMware Tools daemon (vmtoolsd.exe). Adversaries may leverage vmtoolsd.exe to establish persistence by executing various scripting and command-line interpreters such as cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. The rule specifically filters out legitimate VMware Tools scripts related to power management to reduce false positives.
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.
This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
Page 181 of 191