Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the execution of PowerShell commands that utilize the `System.Net.WebClient` object to download files using the `DownloadFile` method. This is a common technique used by adversaries to retrieve malicious payloads or tools from remote servers.
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
Detects the usage of the "ConvertTo-SecureString" cmdlet via the command line within PowerShell or pwsh.exe processes. This activity is generally uncommon and could indicate suspicious behavior, as it is often used to handle sensitive information like passwords, which attackers might try to extract or manipulate.
This rule detects the use of the '::FromBase64String(' function in a command line, which is a common method for decoding Base64 encoded strings in PowerShell. Adversaries often use Base64 encoding to obfuscate malicious commands or payloads, making them harder to detect by signature-based defenses. This detection aims to identify attempts to deobfuscate such encoded content, typically as part of a larger attack chain involving defense evasion and execution.
This rule detects PowerShell commands that utilize encoded arguments such as '-enc', '-ec', or '-en'. Adversaries often use encoded PowerShell commands to obfuscate their malicious scripts, making it harder for security tools and analysts to detect and understand their activities. The rule specifically looks for the execution of 'powershell.exe' or 'powershell_ise.exe' with these encoding flags and attempts to capture and decode the obfuscated command.
Finds PowerShell execution events that could involve a download.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.
This rule detects the use of PowerShell to enumerate successful logon events (Event ID 4624) from the security event log on a Windows host. It specifically looks for command-line executions containing 'Get-EventLog', 'security', and '-instanceid 4624'. This activity is often performed during the reconnaissance phase by adversaries to understand user activity on a system.
This rule detects the creation of remote PowerShell sessions by monitoring for the 'wsmprovhost.exe' process. It triggers when 'wsmprovhost.exe' appears as either the main process image or as a parent process, indicating an active PowerShell remote session, typically facilitated by Windows Remote Management (WinRM).
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Detects suspicious encoded character syntax often used in PowerShell for defense evasion, specifically looking for '[char]0x' or '(WCHAR)0x' in command lines, which are common methods to obfuscate commands.
Detects a renamed PowerShell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths. The rule specifically looks for PowerShell classic logs where the 'HostName' is 'ConsoleHost' but the 'HostApplication' field does not contain typical PowerShell executable paths or names, indicating a potential renaming or masquerading attempt.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
This rule detects the creation of a domain group named "ESX Admins" using either `net.exe` or PowerShell cmdlets like `New-ADGroup`. This activity is highly suspicious and indicates a potential exploitation attempt of CVE-2024-37085. This vulnerability allows an attacker to elevate privileges to full administrative access on a domain-joined ESXi hypervisor, as VMware ESXi hypervisors grant full administrative access by default to members of a domain group named "ESX Admins".
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
PowerShell Web Download
YARA-L
Detects suspicious ways to download files or content using PowerShell
Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string
Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
PowerShell DownloadFile
YARA-L
Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Page 193 of 213