Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,683
9,759
6,695
4,421
3,750
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
This analytic identifies all SIP (Subject Interface Package) providers on a Windows system by capturing DLL paths from relevant events. It is designed to detect potentially malicious SIP providers that could bypass trust controls and allow unauthorized code execution. The rule is intended for hunting and inventory purposes, prompting analysts to review for new and non-standard DLL paths to identify potential threats. If confirmed malicious, such activity could subvert system integrity, leading to unauthorized access or persistent threats.
The analytic detects the use of the `Get-WMIObject Win32_Group` command executed via PowerShell or cmd.exe to enumerate local groups on an endpoint. This activity is often a precursor to privilege escalation or lateral movement, as attackers map out group memberships to identify potential exploitation paths or unauthorized access to sensitive resources.
The analytic detects the execution of the `Get-DomainOU` cmdlet, which is part of the PowerView toolkit. This cmdlet is used for Windows domain enumeration, specifically to gather information about organizational units within Active Directory. Adversaries may use this to map the domain structure, aiding in further exploitation, lateral movement, or privilege escalation. The detection leverages PowerShell Script Block Logging (EventCode=4104).
The analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. This activity is significant as it may indicate an attempt by adversaries to enumerate user accounts for situational awareness or Active Directory discovery. If confirmed malicious, this behavior could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
The analytic detects the execution of a Windows Scheduled Task on demand via the shell or command line. It leverages process-related data, including process name, parent process, and command-line executions, sourced from endpoint logs. The detection focuses on 'schtasks.exe' with an associated 'run' command. This activity is significant as adversaries often use it to force the execution of their created Scheduled Tasks for persistent access or lateral movement within a compromised machine. If confirmed malicious, this could allow attackers to maintain persistence or move laterally within the network, potentially leading to further compromise.
Detects the execution of obfuscated PowerShell one-liners designed to download and execute PowerShell modules in memory. This rule specifically looks for PowerShell command lines containing a URL (e.g., 'http://127.0.0.1'), the 'IRM' (Invoke-RestMethod) alias within a loop ('%{(IRM $_)}'), and the 'Invoke' keyword, which are indicative of in-memory module execution.
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Detects PowerShell execution that utilizes the bitwise XOR (bxor) operator. Attackers may use this as an alternative obfuscation method to Base64 encoded commands to evade detection. Investigation of the command line and process tree is recommended to determine if the activity is malicious.
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
Detects attempts to bypass AMSI (Antimalware Scan Interface) using .NET reflection. This technique involves manipulating the 'amsiInitFailed' field within 'System.Management.Automation.AmsiUtils' to disable AMSI scanning, often seen in PowerShell scripts to evade detection.
Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.
This rule detects a PowerShell downgrade attack where an adversary attempts to force PowerShell to use an older, less secure engine version (2.0) while the host system is configured for a newer version. This technique is often used to bypass security features like Script Block Logging which are present in newer PowerShell versions.
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. The detection relies on the presence of 'FromBase64String' for decoding, 'MemoryStream' for in-memory operations, and 'H4sI' which is a common magic string for Gzip compressed data.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.
Detects suspicious PowerShell invocations using partial parameter names for common obfuscation techniques. This rule specifically looks for truncated forms of parameters like '-windowstyle hidden', '-NoProfile', '-NonInteractive', '-EncodedCommand', and '-ExecutionPolicy Bypass', which are frequently used by adversaries to hide their activity or bypass security measures.
This rule detects instances where PowerShell is invoked, and there's a mismatch between the PowerShell engine version and the host version. Specifically, it looks for PowerShell classic start events where the 'Data' field contains an 'EngineVersion' of 2, 4, or 5, while simultaneously containing a 'HostVersion' of 3. This version mismatch can indicate attempts to evade detection or exploit vulnerabilities by using an older or specific PowerShell engine version within a newer host environment.
Page 21 of 24