Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects Commandlet names and arguments from the Nishang exploitation framework
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Commandline to launch powershell with a base64 payload
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Detects suspicious ways to run Invoke-Execution using IEX alias
Yara rule that detects PoliceRecords ransomware.
Detects suspicious PowerShell invocation with a parameter substring
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)
Page 213 of 213