Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,670
9,759
6,693
4,421
3,749
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable.
This rule detects PowerShell scripts that attempt to retrieve Access Control Lists (ACLs) for service-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services. This activity could indicate an adversary performing reconnaissance for service registry permissions weaknesses, which can be exploited for privilege escalation or persistence. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services if permissions are misconfigured.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
The analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
The analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving `system.net.webclient` and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
This analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. This pattern is often indicative of obfuscated scripts or those attempting to download secondary payloads. Such activity may signal an attempt to execute malicious code, download additional malware, lead to further system compromise, or data exfiltration. Review parallel processes and the full script block for additional context and related artifacts.
The analytic detects the use of `GetProcAddress` within PowerShell script blocks, captured via PowerShell Script Block Logging (EventCode=4104). The presence of `GetProcAddress` in PowerShell is often indicative of malicious activity, such as process injection or other code execution techniques, as it allows for dynamic resolution of API functions. This behavior is unusual for legitimate PowerShell scripts and suggests an attacker is attempting to execute arbitrary code, potentially leading to system compromise. Analysts should investigate the full script block and any associated processes.
This rule detects the use of various command-line tools and PowerShell cmdlets that can initiate web requests. These include native Windows PowerShell cmdlets like 'Invoke-RestMethod', 'Invoke-WebRequest', 'Resume-BitsTransfer', 'Start-BitsTransfer', and their aliases ('irm', 'iwr'), as well as common command-line utilities like 'curl' and 'wget', and .NET framework calls such as '[System.Net.WebRequest]::create' and 'WinHttp.WinHttpRequest'. Adversaries often use these methods to download additional tools, malware, or exfiltrate data from a compromised system.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the `Compress-Archive` command targeting the `Temp` directory. This activity is significant as it may indicate an adversary's attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects a PowerShell command that carves an MSI file from a source file by searching for a specific byte sequence ('UUUU' or 0x55 four times). This novel technique has been used by a Chinese APT group as part of their infection chain, often initiated by a malicious LNK file.
Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.
This rule detects PowerShell or pwsh.exe process creations that include command-line arguments indicative of image file manipulation and obfuscation techniques. Specifically, it looks for the presence of image file extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif) combined with PowerShell commands or .NET methods related to base64 decoding, expression invocation, command invocation, GDI+ graphics operations (System.Drawing, Bitmap, GetPixel, SetPixel, LockBits, UnlockBits, PixelFormat), or file content reading ([IO.File]::ReadAllBytes, Get-Content). Additionally, it checks for common obfuscation or execution flags such as '-enc', '-encoded', '-e', '-w hidden', '-windowstyle hidden', '-nop', '-noprofile', '-ep bypass', or '-executionpolicy bypass'. This combination suggests an attempt to execute malicious code hidden within image files, often using steganography or other covert methods.
Detects the use of various CLI utilities exfiltrating data via web requests
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Page 15 of 24