Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,439
11,829
5,873
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.
This rule detects the execution of `SyncAppvPublishingServer.vbs` with a command-line argument containing a semicolon, which is indicative of arbitrary PowerShell code execution. Adversaries can abuse this legitimate VBScript to bypass PowerShell execution restrictions and evade defensive measures by proxying execution through a trusted, signed binary.
Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.
Detects the use of the Microsoft signed script "CL_mutexverifiers.ps1" to proxy the execution of additional PowerShell script commands. This technique can be used by adversaries for defense evasion by leveraging a trusted, signed script to execute malicious code.
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Detects code fragments commonly found in small and obfuscated PowerShell scripts designed to bypass Antimalware Scan Interface (AMSI). The rule specifically looks for the combination of '[Ref].Assembly.GetType', 'SetValue($null,$true)', and 'NonPublic,Static' within PowerShell script block text, which are indicative of reflection-based AMSI bypass techniques.
This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.
This rule detects the use of `System.DirectoryServices.AccountManagement` within PowerShell script block logs. This .NET namespace is commonly used to programmatically manage Active Directory security principals such as users, computers, and groups. Adversaries may use this method to create new domain accounts, modify existing ones, or manipulate group memberships to establish persistence or elevate privileges within an Active Directory environment.
Detects PowerShell scripts that enumerate installed hotfixes by querying 'Win32_QuickFixEngineering' and looking for 'HotFixID'. This activity is often performed by attackers during the discovery phase to gather system information.
This rule detects the use of PowerShell to instantiate the MsXml2.XmlHttp COM object. Adversaries may abuse PowerShell commands and scripts for execution, and the MsXml2.XmlHttp COM object can be used for network communication, such as downloading additional payloads or exfiltrating data. This technique is often used by malware or attackers to perform actions like C2 communication or data transfer.
Detects attempts to write data into NTFS Alternate Data Streams (ADS) using PowerShell cmdlets like `Set-Content` or `Add-Content` in conjunction with the `-Stream` parameter. This technique can be used by adversaries to hide malicious data or executables on a system.
Detects the use of the PSAttack PowerShell hack tool by looking for the specific string 'PS ATTACK!!!' within PowerShell script block logs. This tool is often used for post-exploitation activities.
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Detects PowerShell script blocks that manipulate security descriptors using specific WMI classes and properties (win32_Trustee, win32_Ace, .AccessMask, .AceType, .SetSecurityDescriptor) in conjunction with specific LSA registry paths (Lsa\JD, Lsa\Skew1, Lsa\Data, Lsa\GBG). This combination is indicative of potential persistence mechanisms, as seen in projects like DAMP, which aim to backdoor systems by modifying security settings to maintain access or elevate privileges.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Page 188 of 191