Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
19
5
Contributors
19
5
Categories
10
8
5
5
3
Platforms
19
4
1
Products / Services
9
9
4
3
2
MITRE Techniques
10
9
9
8
7
CVEs
71
71
64
58
49
24
Detects suspicious patterns in PowerShell command lines that indicate the use of `Invoke-Expression` (IEX) for potentially malicious code execution. This rule looks for various obfuscated or unusual ways IEX might be invoked, often in conjunction with base64 encoded strings, to execute arbitrary commands or scripts.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
Detects suspicious ways to run Invoke-Execution using IEX alias
Page 2 of 2