Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects creation of a local user via PowerShell
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects use of WinAPI functions in PowerShell scripts
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
Detects Commandlet names from ShellIntel exploitation scripts.
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects Obfuscated use of stdin to execute PowerShell
Detects powershell scripts that import modules from suspicious directories
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Commandlet names and arguments from the Nishang exploitation framework
Detects Obfuscated Powershell via Stdin in Scripts
Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects a network connection that was initiated from a PowerShell process.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Page 186 of 213