Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Malicious emails often contain documents and other specially crafted attachments that run PowerShell commands to deliver additional payloads. If you are aware of emails coming from a known malicious sender, you can use this query to list and review PowerShell activities that occurred within 30 minutes after an email was received from the sender .
Detects suspicious PowerShell invocation command parameters
Dnscat Execution
Sigma
Dnscat exfiltration tool execution
Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets
Detects usage of "xor" or "bxor" in combination of a "foreach" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports
Detects new commands that add new printer port which point to suspicious file
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189
Detects command line patterns used by BlackByte ransomware in different operations
Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team
Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs
Detects potential execution of the PowerShell script POWERTRASH
Detects Rorschach ransomware execution activity
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
Detects commands used by Turla group as reported by ESET in May 2020
Detects Obfuscated use of stdin to execute PowerShell
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Page 183 of 213