Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,683
9,759
6,695
4,421
3,750
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects PowerShell or .NET code modifying ServicePointManager or certificate validation callbacks so later downloads accept untrusted certificates. This behavior is often associated with malware like InstallFix to bypass security measures during C2 communication or payload delivery.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects PowerShell invoking Add-Type to compile C# code inline, indicative of PS1Bot malware. Specifically looks for the use of 'Add-Type' in PowerShell command lines combined with specific C# methods like 'SetWindowsHookEx', 'Graphics', or 'CopyFromScreen', which are often used for screen capture or other malicious activities.
Correlates the Get-Clipboard cmdlet execution natively invoked by the user shell, proving the "paste-to-run" ClickFix mechanism. This rule specifically looks for PowerShell execution of 'Get-Clipboard' where the initiating process is 'explorer.exe'.
Detects PowerShell utilizing [Runtime.InteropServices.Marshal]::WriteInt32 to overwrite the amsiContext memory space with 0x41414141, indicating an attempt to bypass AMSI.
Detects QoS policy creation with a throttle rate applied, targeting EDR disconnection via extreme low bandwidth. This rule specifically looks for PowerShell commands that include 'ThrottleRateActionBitsPerSecond' in their additional fields, indicating an attempt to set a very low bandwidth throttle.
Detects the creation of Quality of Service (QoS) policies via PowerShell that explicitly target known Endpoint Detection and Response (EDR) agent executables. This activity could indicate an adversary attempting to degrade or block EDR telemetry to evade detection.
Detects enumeration of existing QoS policies via PowerShell, potentially used by attackers to verify throttling. This rule specifically looks for the execution of the 'Get-NetQosPolicy' command within PowerShell.
Detects PowerShell commands that contain a reversed string pattern often used by Vidar malware to de-obfuscate its C2 endpoint at runtime. The specific pattern 'txt.[0-9a-zA-Z]+/selif_cilbup' is indicative of this technique.
Identifies PowerShell commands that copy a .bat file from the %TEMP% directory to the Startup folder, a technique used by Vidar malware for persistence.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects 1027 test "Execute base64-encoded PowerShell from Windows Registry" (Obfuscated Files or Information) using command-line and process indicators derived from executor behavior.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.
Detects PowerShell executing a one-liner Invoke-WebRequest to pull the TiFlux installer directly from an attacker-hosted repository or the vendor.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load to execute the compiled ClassLibrary stage filelessly.
Page 8 of 24