Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Detects the execution of the CSharp interactive console (csi.exe) when it is spawned by PowerShell. This activity can be indicative of an adversary leveraging trusted developer utilities for proxy execution, potentially to bypass application controls or execute malicious code.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
The following analytic identifies child processes spawned from "mshta.exe". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like "powershell.exe" and "cmd.exe". This activity is significant because "mshta.exe" is often exploited by attackers to execute malicious scripts or commands. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment. Monitoring this activity helps in early detection of potential threats leveraging "mshta.exe" for malicious purposes.
This analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as SharpHound is commonly used for Active Directory enumeration, which can be a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially compromising sensitive information and critical systems.
The analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`, and `IO.MemoryStream`. This activity is significant as it indicates potential fileless malware execution, which is harder to detect and can bypass traditional file-based defenses. If confirmed malicious, this technique could allow attackers to execute code in memory, evade detection, and maintain persistence in the environment.
The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because AzureHound is often used for reconnaissance in Azure environments, potentially exposing sensitive information. If confirmed malicious, this activity could allow an attacker to map out Azure Active Directory structures, aiding in further attacks and privilege escalation.
This analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. This activity is significant as it often indicates lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.
This analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. This detection leverages Azure AD SignInLogs to identify successful logins where the appDisplayName is "Microsoft Azure PowerShell." This activity is significant because it is uncommon for regular, non-administrative users to authenticate using PowerShell, and it may indicate enumeration and discovery techniques by an attacker. If confirmed malicious, this activity could allow attackers to perform extensive reconnaissance, potentially leading to privilege escalation or further exploitation within the Azure environment.
The analytic detects the execution of Windows shell processes initiated by WinRAR, such as "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". This activity is significant because it may indicate exploitation of the WinRAR CVE-2023-38831 vulnerability, where malicious scripts are executed from spoofed ZIP archives. If confirmed malicious, this could lead to unauthorized access, financial loss, and further malicious activities like data theft or ransomware attacks.
The following analytic detects the creation of shadow copies using "wmic" or "Powershell" commands. It leverages the Endpoint.Processes data model in Splunk to identify processes where the command includes "shadowcopy" and "create". This activity is significant because it may indicate an attacker attempting to manipulate or access data in an unauthorized manner, potentially leading to data theft or manipulation. If confirmed malicious, this behavior could allow attackers to backup and exfiltrate sensitive data or hide their tracks by restoring files to a previous state after an attack.
This analytic detects the use of PowerShell to delete shadow copies, a common tactic used by ransomware to prevent data recovery. It specifically looks for PowerShell Script Block Logging (EventCode 4104) events containing keywords like "ShadowCopy" along with "Delete" or "Remove" in the ScriptBlockText. Successful execution of such commands can lead to irreversible data loss and hinder recovery efforts.
The analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. It identifies script blocks containing `[adsisearcher]`, `objectcategory=user`, and `.findAll()` from PowerShell Script Block Logging (EventCode=4104). This activity may indicate an attempt by adversaries or Red Teams to enumerate domain users for situational awareness and Active Directory discovery, potentially leading to further reconnaissance, privilege escalation, or lateral movement.
This rule detects suspicious PowerShell commands that modify firewall rules to allow inbound traffic to a specific local port. This activity is significant because it may indicate an attacker attempting to establish remote access by modifying firewall rules, potentially leading to unauthorized access and further exploitation.
The following analytic detects the execution of known MailSniper PowerShell functions on a machine. It leverages PowerShell logs (EventCode 4104) to identify specific script block text associated with MailSniper activities. This behavior is significant as MailSniper is often used by attackers to harvest sensitive emails from compromised Exchange servers. If confirmed malicious, this activity could lead to unauthorized access to sensitive email data, credential theft, and further compromise of the email infrastructure.
This analytic detects the execution of the `Get-DomainSPNTicket` commandlet, which is part of the PowerView tool, by monitoring PowerShell Script Block Logging (EventCode=4104). This commandlet is used to request Kerberos service tickets for specified Service Principal Names (SPNs). Detecting this activity is critical because it can indicate attempts to perform Kerberoasting, a technique where attackers extract SPN account passwords for offline cracking. If this activity is confirmed to be malicious, it could lead to unauthorized access to sensitive accounts, potentially resulting in privilege escalation and further compromise of the network.
This analytic detects the use of the Get-ADComputer cmdlet with parameters indicating a search for Windows endpoints with Kerberos Unconstrained Delegation. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific activity. This behavior is significant as it may indicate an attempt by adversaries or Red Teams to gain situational awareness and perform Active Directory discovery. If confirmed malicious, this activity could allow attackers to identify high-value targets for further exploitation, potentially leading to privilege escalation or lateral movement within the network.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes with abnormally large padding (50 or more spaces) in the command line. This specific pattern is a key indicator of the ZDI-CAN-25373 Windows shortcut zero-day vulnerability exploitation, where threat actors craft malicious LNK files containing padded content to trigger code execution. The excessive spacing in the command line is used to manipulate the way Windows processes the shortcut file, enabling arbitrary code execution. This technique has been actively exploited by multiple APT groups in targeted attacks, with malicious LNK files being delivered through both HTTP and SMB protocols. The presence of significant command line padding when Explorer.exe launches command shells is highly suspicious and warrants immediate investigation.
Page 194 of 213