Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,683
9,759
6,695
4,421
3,750
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.
Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.
This rule detects the use of PowerShell (powershell.exe or pwsh.exe) to download files from known file-sharing or content delivery network (CDN) domains. It specifically looks for command-line arguments indicative of file download operations, such as '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', and 'wget'. The rule aims to identify suspicious activity where PowerShell is leveraged to retrieve potentially malicious payloads from untrusted or commonly abused online services.
Detects attempts to access the PowerShell console history file (ConsoleHost_history.txt) or retrieve its path. This activity can indicate an adversary attempting to gather plaintext credentials or perform reconnaissance on previously executed commands.
This analytic identifies the execution of the PowerShell cmdlet `Get-WebGlobalModule`, which lists all IIS Modules installed on a system. It leverages PowerShell input data to detect this activity by capturing the module names and the image paths of the DLLs. This activity is significant for a SOC because it can indicate an attempt to enumerate installed IIS modules, which could be a precursor to exploiting vulnerabilities or misconfigurations. If confirmed malicious, this could allow an attacker to gain insights into the web server's configuration, potentially leading to further exploitation or privilege escalation.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
Detects PowerShell commands that use Get-WmiObject to query Win32_Process, specifically looking for process names. This can be indicative of discovery or reconnaissance activities using WMI.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
This activity may indicate that a threat actor is performing process discovery to gather information such as the Process ID, executable path, command-line arguments, and other related data.
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
The following analytic detects the execution of the `Get-DomainUser` or `Get-NetUser` PowerShell cmdlets with the `-SPN` parameter, indicating the use of PowerView for SPN discovery. It leverages PowerShell Script Block Logging (EventCode=4104) to identify these specific commands. This activity is significant as it suggests an attempt to enumerate domain accounts associated with Service Principal Names (SPNs), a common precursor to Kerberoasting attacks. If confirmed malicious, this could allow an attacker to identify and target accounts for credential theft, potentially leading to unauthorized access and privilege escalation within the network.
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.
Catches PowerShell processes with both Base64 decoding and network download capabilities, indicating potential remote payload execution typical of advanced ClickFix attacks.
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on:
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
This rule detects the execution of PowerShell with suspicious command-line arguments (such as base64 encoded strings, Invoke-Expression, or encoded commands) when the parent process is a web browser. This behavior is often indicative of drive-by downloads, malicious advertisements, or exploitation of browser vulnerabilities leading to the execution of malicious PowerShell scripts.
This rule detects suspicious PowerShell script execution that attempts to identify installed anti-virus products using WMI or PowerShell commands. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is often performed by malware and APT actors to map security applications for evasion purposes, potentially leading to the disabling or bypassing of security measures.
This detection identifies attempts to execute PowerShell commands that have been obfuscated using Base64 encoding. Attackers frequently employ Base64 encoding to conceal malicious scripts, evade signature-based antivirus solutions, and make it more difficult for security analysts to quickly understand their true intent.
Page 16 of 24