Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
500 detections
Filters
Last updated
All Time
Detection languages
169
128
91
35
28
Contributors
126
101
86
42
23
Categories
313
291
224
193
41
Platforms
483
10
4
3
2
Products / Services
10,683
9,759
6,695
4,421
3,750
500
MITRE Techniques
307
277
204
85
74
CVEs
5
4
4
3
2
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Identifies PowerShell commands that generate a unique victim ID by hashing the concatenated ComputerName and UserName, a technique used by the InstallFix malware.
Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.
Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.
Detects PowerShell using Net.WebClient to download an MSI payload. This technique is often used by adversaries to download and execute malicious installers.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
Detects rapid clipboard monitoring and substitution behavior via PowerShell APIs.
This YARA rule detects the presence of various PowerShell commands and functions that are commonly used in malicious scripts. It looks for a combination of specific cmdlets like 'New-Object', 'Invoke-WebRequest', 'Invoke-Expression', 'Set-ExecutionPolicy Bypass', and 'Add-Type', as well as patterns for functions that might be used for obfuscation or specific malicious activities (e.g., 'vS35wIDY9U', 'wEAXbwCuxi'). The rule triggers if at least three of the defined strings or regular expressions are found, indicating potential PowerShell-based malicious activity.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup. This technique was observed in a campaign deploying obfuscated batch scripts disguised as PNG files into the Startup folder.
Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
Page 9 of 24