Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
This rule detects PowerShell processes initiated with command-line arguments that indicate obfuscation (e.g., -enc, -encodedCommand) or attempts to download or execute external content (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is commonly observed during the initial execution of malicious payloads or tool delivery.
Detects the invocation of powershell.exe or pwsh.exe using encoded command flags (-EncodedCommand/-enc) in combination with stealth-oriented arguments such as -WindowStyle Hidden or -NoProfile. This pattern is frequently utilized by threat actors to execute obfuscated, malicious scripts while bypassing command-line visibility and standard profile configurations.
This rule detects potentially malicious PowerShell activity by identifying common obfuscation patterns, including encoded commands (Base64), IEX (Invoke-Expression) download cradles, and execution with hidden windows. It triggers when multiple suspicious flags are present or when an unusually long encoded blob is identified in script blocks, command lines, or process arguments.
This rule detects HTTP GET requests initiated by the Windows PowerShell User-Agent where the destination host is a decimal-encoded IP address. This pattern is commonly associated with ClickFix-style social engineering attacks, where users are tricked into executing obfuscated PowerShell commands to download malicious payloads.
Detects a behavioral pattern associated with the NeedyMantis first-stage loader, which involves the loading of specific suspicious DLLs (masquerading as common software components) followed by the extraction or creation of an 'encryptbase64.ps1' second-stage loader within a short timeframe (10 minutes) on the same host.
Detects HTTP traffic where the Host header contains a decimal-encoded IP address, which is a technique often used in stager evasion and obfuscation (notably associated with 'ClickFix' or similar browser-based malvertising campaigns) to bypass domain-based filtering or reputation systems.
Detects potentially malicious PowerShell command-line activity by identifying patterns indicative of obfuscation, fileless execution, AMSI bypass, and downloading/executing remote payloads. The rule flags instances where long command lines are used with encoded flags, base64 decoding logic is paired with execution primitives, explicit AMSI bypass attempts, or combinations of encoded commands with web requests or hidden windows.
Detects the use of PowerShell to download content from a remote URI and execute it using encoded commands or expression evaluation, a pattern commonly used by the FIN8 threat group (Syssphinx) to deploy the BADHATCH backdoor.
Detects the execution of potentially malicious processes mimicking cryptocurrency or wallet applications (e.g., 'wallet', 'coin', 'crypto', 'exchange') that are launched from user-accessible directories like Downloads or Temp. The detection specifically looks for these processes spawning command-line interpreters (cmd.exe, powershell.exe) or proxy execution binaries (rundll32.exe), a behavior pattern characteristic of the AppleJeus campaign associated with Lazarus Group (Diamond Sleet).
Detects instances where a Claude process accesses a 'SKILL.md' file, followed closely by a suspicious command execution on the same device. The rule specifically targets command-line activity that involves encoding, download-and-execute patterns, staging in sensitive directories, or communication with suspicious domains/IPs, which is indicative of a supply-chain or poisoned agent-skill file attack.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
Detects a behavioral fingerprint associated with the NeedyMantis group, characterized by the creation of a DLL and a identically-named, extensionless, encrypted archive file in the same directory within a short time window. This approach identifies the underlying packaging strategy rather than relying on static file names or known paths.
Detects .ps1-named files dropped to disk that are never actually executed by a PowerShell interpreter (powershell.exe / pwsh.exe) within a short window afterward. NeedyMantis's second-stage loader (e.g. encryptbase64.ps1) is raw x64 shellcode, not a real script -- it's read and executed directly by the dropping process, so no genuine PowerShell host process ever references the file by name. Replaces an earlier version of this rule that watched DeviceImageLoadEvents for a .ps1 extension: Windows can only emit an image-load event for a file with a valid PE header loaded via the OS loader, and raw shellcode has no PE header and is never mapped that way, so that approach would not have fired on this malware. Caveat: legitimate deployment tooling that stages a script for delayed or remote execution can also produce this create/execute mismatch; tune the window and add known-good deployment-tool exclusions for your environment.
Detects suspicious command line patterns on macOS where base64 encoded strings are decoded and piped directly into a shell interpreter (bash/zsh/sh). This pattern is commonly used by adversaries to execute obfuscated payloads or scripts directly in memory.
Detects a fake ClaudeDesktop.exe installer / tampered libcef.dll sideload chain deploying the SectopRAT .NET RAT, requiring multiple corroborating indicators and a PE anomaly consistent with DLL sideloading rather than a single generic string
Detects the execution of the suspicious shared library 'liblocal-service.so' from the '/data/local/tmp/' directory, initiated by the 'shell' user or an ADB parent process. This activity is associated with malicious behavior where Android debug bridge (ADB) is abused to stage and execute native daemons for privilege escalation or unauthorized system access.
Detects the execution of bash commands that contain base64 decoding flags, typically used to obfuscate command-line arguments to evade detection, initiated from a terminal application.
Detects unpacked Sauron Loader malware samples by identifying specific embedded configuration artifacts, including a fixed magic header value (0xbaadf00d), internal marker strings, and associated test identifiers for group and build IDs.
Detects instances where a Claude process accesses a 'SKILL.md' file, followed closely by a suspicious command execution on the same device. The rule specifically targets command-line activity that involves encoding, download-and-execute patterns, staging in sensitive directories, or communication with suspicious domains/IPs, which is indicative of a supply-chain or poisoned agent-skill file attack.
Detects activity indicative of the 'ClickFix' social engineering technique, where users are tricked into manually executing obfuscated commands (often from fake CAPTCHA or error prompts) via the Windows Run dialog or command-line interfaces. The rule correlates suspicious process execution (e.g., mshta, powershell, certutil, curl) originating from explorer.exe with the detection of common encoded/obfuscated command line patterns, or interactions with the Windows RunMRU registry key, which logs commands typed into the Run dialog.
Detects a .ps1-named file being loaded as an executable image or created as a process's own file name (both anomalous under normal Windows semantics, since PowerShell always runs scripts via powershell.exe/pwsh.exe as the process image, never as the .ps1 itself). Anchored to the known NeedyMantis sideload staging folders to exclude unrelated developer/test tooling elsewhere on disk that might trip a similar anomaly.
Page 3 of 81