Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,464 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,669
2,391
1,718
312
Platforms
4,409
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,464
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
This rule detects suspicious command line patterns associated with MERCURY APT activity. Specifically, it looks for PowerShell execution with parameters '-exec bypass -w 1 -enc' combined with a base64 encoded string that decodes to 'Start-Job -ScriptBlock'. This indicates the execution of an encoded PowerShell script, often used by adversaries to obfuscate their commands and evade detection.
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by PowerShell. Adversaries may abuse BITS jobs for persistence, execution, or data transfer, and using PowerShell to create these jobs is a common method.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
This rule detects when PowerShell (powershell.exe or pwsh.exe) creates a new PowerShell script file (.ps1). While this behavior can be benign in many cases, it can also indicate a dropper script attempting to establish persistence on a system. The rule filters out common legitimate scenarios such as PowerShell's internal script policy tests and temporary files created in user AppData\Local\Temp or C:\Windows\Temp directories.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.
Detects the execution of PowerShell scripts obfuscated using techniques associated with Invoke-Obfuscation, specifically when launched via rundll32.exe and shell32.dll. This method is often used by adversaries to evade detection and execute malicious PowerShell code.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.
This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.
Detects the creation of suspicious processes (like command interpreters or scripting engines) as child processes of the Serv-U.exe application. This pattern is indicative of potential exploitation of the Serv-U service, possibly through vulnerabilities like CVE-2021-35211, leading to arbitrary command execution.
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
This rule detects the use of PowerShell's `Remove-Item` cmdlet or its aliases (`del`, `erase`, `rd`, `ri`, `rm`, `rmdir`) with the `-Path` parameter within a PowerShell script block. This activity is indicative of file or folder deletion, which can be used by adversaries for defense evasion or to remove traces of their activity.
Detects obfuscated PowerShell commands being executed via standard input (stdin) by monitoring Windows Security Event ID 4697. The rule looks for specific keywords like 'set', '&&', 'environment', 'invoke', and '${input)' within the ServiceFileName field, which can indicate attempts to bypass detection by passing obfuscated scripts or commands directly to PowerShell.
Detects obfuscated use of stdin to execute PowerShell commands, specifically looking for the creation of a service with a command line containing 'cmd', 'powershell', input redirection ('${input}'), 'noexit', and command execution flags (' /c ', ' /r '). This pattern is indicative of techniques used by tools like Invoke-Obfuscation to hide malicious PowerShell execution.
Detects obfuscated use of environment variables to execute PowerShell commands. This technique is often used by adversaries to evade detection by security products. The rule specifically looks for the creation of a service with a command-line containing 'cmd', 'set', '-f', and either '/c' or '/r', which are indicative of a PowerShell command being constructed and executed via environment variables.
Page 202 of 213