Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,683
9,759
6,695
4,421
3,750
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.
Detects PowerShell command lines attempting to disable AMSI (Antimalware Scan Interface) by leveraging 'AmsiUtils' and 'amsiContext'. This technique is often used by adversaries to evade security controls that rely on AMSI for script scanning.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects attempts to abuse Windows Defender Application Control (WDAC) policies, specifically looking for the execution of 'RefreshPolicy.exe' or PowerShell commands containing 'Merge-CIPolicy'. This activity is associated with the Interlock threat group, which is known to drop custom WDAC policies to allow their tooling and block EDR components.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.
Vidar In Memory Assembly
YARA-L
Identifies PowerShell dynamically converting the extracted Base64 string into bytes and loading it directly into memory.
Identifies PowerShell dynamically converting a Base64 string into bytes and loading it directly into memory, a technique often used by malware like Vidar for reflective code loading.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects the use of PowerShell with 'Invoke-WebRequest' to download trojanized installers (MicrosoftEdgeSetup.exe, ChromeSetup.exe, MSTeamsSetup.exe) from malicious domains like 'apple-online.shop' or 'trycloudflare.com', as observed in Interlock activity leveraging JunkFiction.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects PowerShell execution attempting to interact with AppX packages using 'DiscCoerceProbe'. This activity is often associated with privilege escalation or system manipulation techniques.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Page 7 of 24