Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects attempts to delete or resize Volume Shadow Copies using various Windows operating system utilities. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for command-line executions of `powershell.exe`, `pwsh.exe`, `wmic.exe`, `vssadmin.exe`, `diskshadow.exe`, and `wbadmin.exe` with arguments indicating shadow copy deletion or resizing operations. This includes commands like 'shadow delete', 'wbadmin delete catalog', and 'vssadmin resize shadowstorage'.
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
Detects the usage of `[Reflection.Assembly]::load` functions within PowerShell script block logs. This method allows for dynamically loading assemblies into memory, which can be used by adversaries to execute malicious code without writing it to disk, thus evading traditional file-based detections.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
Detects PowerShell script block logging (Event ID 4104) entries that indicate the use of Invoke-Obfuscation's COMPRESS obfuscation technique. This technique typically involves using 'new-object' with 'text.encoding::ascii' and 'system.io.compression.deflatestream' or 'system.io.streamreader' followed by 'readtoend' to decompress and execute obfuscated code.
This rule detects the execution of PowerShell commandlets and functions associated with the Nishang exploitation framework. Nishang is a collection of PowerShell scripts and functions that enable penetration testers to use PowerShell for offensive security tasks. The rule specifically looks for a comprehensive list of known Nishang commandlet names and arguments within PowerShell script block logs. Detection of these strings indicates potential malicious activity, including credential dumping, persistence mechanisms, exfiltration, and remote code execution.
Detects the execution of PowerShell cmdlets associated with PowerView, a reconnaissance tool within the PowerSploit framework. This rule specifically looks for a comprehensive list of PowerView cmdlets within PowerShell script block logs, indicating potential adversary activity related to discovery and information gathering in an Active Directory environment.
Detects the use of 'PSAsyncShell', an asynchronous TCP reverse shell written in PowerShell. The rule specifically looks for the string 'PSAsyncShell' within PowerShell script block logs, indicating the execution or presence of this specific tool.
This rule detects the execution of PowerShell scripts containing specific Base64 encoded shellcode signatures. The rule looks for the presence of 'OiCAAAAYInlM' or 'OiJAAAAYInlM' within the ScriptBlockText, which are known indicators of shellcode.
This rule detects the execution of specific PowerShell commandlets associated with the ShellIntel exploitation framework. These commandlets, such as 'Invoke-SMBAutoBrute', 'Invoke-GPOLinks', and 'Invoke-Potato', are commonly used for reconnaissance, privilege escalation, and lateral movement within a Windows environment. Detection relies on PowerShell Script Block Logging to capture the script text containing these commandlet names.
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.
This rule detects the execution of `SyncAppvPublishingServer.vbs` with a command-line argument containing a semicolon, which is indicative of arbitrary PowerShell code execution. Adversaries can abuse this legitimate VBScript to bypass PowerShell execution restrictions and evade defensive measures by proxying execution through a trusted, signed binary.
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.
Detects the use of the Microsoft signed script "CL_mutexverifiers.ps1" to proxy the execution of additional PowerShell script commands. This technique can be used by adversaries for defense evasion by leveraging a trusted, signed script to execute malicious code.
This rule detects the usage of the 'ConvertTo-SecureString' cmdlet via the command line. This cmdlet is used to convert plain text into a secure string object, which can then be used to store sensitive information like passwords. While it has legitimate uses, its direct invocation from the command line is uncommon in typical user activity and can indicate suspicious behavior, potentially related to credential manipulation or obfuscation techniques by adversaries.
Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Page 206 of 213