Unknown detection rules
Every published rule under Unknown, with the source it came from, the licence it carries and the ATT&CK techniques it covers.
- matching detections
Loading detections…
Loading detections
Every published rule under Unknown, with the source it came from, the licence it carries and the ATT&CK techniques it covers.
Loading detections…
Looks for valid variations of the -EncodedCommand parameter. Commonly used to encode or obfuscate commands, and not all occurrences are malicious.
Published to signed-in readers
The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.