Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
114
59
26
14
14
Contributors
78
29
27
23
19
Categories
170
137
66
57
39
Platforms
207
22
19
9
2
Products / Services
97
54
31
25
11
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell
This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.
Detects potential command-line obfuscation techniques using escape characters, specifically looking for 'h^t^t^p' or 'h"t"t"p' patterns in process command lines. This method is often used by adversaries to evade detection by security tools that might be looking for cleartext indicators like URLs.
Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Page 13 of 13