Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.
Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be an indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. The usage of the WindowsInstaller COM object rather than msiexec could be an attempt to bypass detection.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Detects command line parameters used by Bloodhound and Sharphound hack tools
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
Detects the execution of a PowerShell command that downloads and executes a script from Pastebin, as seen in the Discord Invite Loop Hole campaign. This is the first stage after the user is tricked into pasting the command.
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Detects suspicious PowerShell invocation command parameters
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986
Detects command line parameters used by Bloodhound and Sharphound hack tools
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.
Detects base64 encoded listing Win32_Shadowcopy
Page 173 of 213