Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects suspicious encoded character syntax often used for defense evasion
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Detects various execution patterns of the CrackMapExec pentesting framework
Detects inline execution of PowerShell code from a file
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects suspicious command lines used in Covenant luanchers
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
This could be a sign of obfuscation of a fat finger problem (typo by the developer).
Detects suspicious powershell command line parameters used in Empire
Detects Obfuscated use of Environment Variables to execute PowerShell
Page 184 of 213