Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,439
11,829
5,873
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
This rule detects outbound network connections initiated by the Windows Script Host interpreters, wscript.exe or cscript.exe, to non-local IP addresses. This behavior is often indicative of adversaries using scripts to download additional malicious payloads or establish command and control. The rule filters out connections to common private and loopback IP ranges to reduce false positives.
This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.
Detects suspicious invocation of the Get-ADDBAccount PowerShell script that reads from an ntds.dit file. This technique can be used to gain access to credentials without relying on traditional credential dumping tools. The rule specifically looks for the presence of 'Get-ADDBAccount', 'BootKey', and 'DatabasePath' in the PowerShell payload, indicating an attempt to extract credentials from an NTDS database file.
Detects various obfuscated PowerShell IEX (Invoke-Expression) invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for unique string manipulation techniques used by Invoke-Obfuscation to construct PowerShell commands, often involving concatenation of environment variables or special PowerShell variables and their indices.
Detects obfuscated PowerShell code being executed via standard input (stdin) within PowerShell module logs. This technique is often used by adversaries to evade detection by security products that monitor for suspicious commands or scripts.
Detects obfuscated PowerShell execution attempts that leverage rundll32.exe and shell32.dll. The rule looks for specific keywords in the PowerShell module payload, such as '&&', 'rundll32', 'shell32.dll', 'shellexec_rundll', combined with common PowerShell execution terms like 'value', 'invoke', 'comspec', or 'iex'. This combination suggests an attempt to bypass detection by using rundll32.exe to launch obfuscated PowerShell commands.
Detects the use of specific strings or NULL bits within PowerShell scripts that are commonly employed to bypass Antimalware Scan Interface (AMSI) functionalities. This technique aims to prevent security products from inspecting malicious script content.
Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects the usage of the "Add-AppxPackage" or its alias "Add-AppPackage" with the "-AllowUnsigned" flag to install unsigned AppX packages. This can be used by adversaries for persistence or defense evasion by installing malicious applications that bypass signature checks.
Detects highly obfuscated PowerShell commands using a specific pattern associated with 'VAR++ LAUNCHER' obfuscation techniques, often employed by tools like Invoke-Obfuscation. The rule looks for a regex pattern that includes '&&set', repeated curly brace digits (e.g., '{1}{2}'), '-f', and 'cmd /c', indicating an attempt to construct and execute a command in an obfuscated manner.
Detects obfuscated PowerShell code being executed via standard input (stdin) within script block logs. This often indicates an attempt to evade detection by hiding malicious commands.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects the use of the PowerShell 'Write-EventLog' cmdlet in conjunction with the '-RawData' flag. This combination can be exploited by adversaries to embed malicious payloads within Windows Event Logs, which can then be retrieved later. This technique is often employed for defense evasion, allowing attackers to conceal their activities within seemingly legitimate system logs. Detection relies on PowerShell Script Block Logging being enabled.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.
This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.
This rule detects the use of obfuscated environment variables to execute PowerShell commands via `cmd.exe`. Specifically, it looks for command lines where `cmd.exe` is used with `/c` or `/r` to set an environment variable (e.g., `SET VAR=...`) followed by a PowerShell command that leverages string formatting (`(?:{\d}){1,}\\"\s+?\-f(?:.*\)){1,}.*\"`) to reconstruct and execute code. This technique is often employed by adversaries to evade detection by security tools that might monitor for direct PowerShell execution or specific command-line patterns.
Page 190 of 191