Paste a Sigma, KQL, SPL, or YARA-L rule. Get an instant quality scorecard: false-positive risk, SIEM performance cost, MITRE ATT&CK coverage, lint findings, and an AI-generated fix.
title: Suspicious PowerShell Download Cradle
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\\powershell.exe'
CommandLine|contains:
- 'DownloadString'
- 'Invoke-WebRequest'
condition: selection
level: highDetection teams spend hours reviewing rule quality by hand. DetectionLint does it in seconds — and catches patterns humans forget.
Broad-process-no-parent-filter, unanchored regex, mutually-exclusive conditions — we check the patterns that actually flood your SOC.
Every rule gets an FP risk score 0–10 with reasoning. "Matches powershell.exe without parent filter — expect heavy false positives."
Auto-extract technique tags from your rule. Cross-reference against coverage gaps in your detection inventory.
Click once. Get an improved version of your rule with a diff — addressing lint findings while preserving detection intent.
Curated Sigma, KQL, SPL, and YARA-L rules from trusted upstream repos — each pre-scored for quality. Fork into your library with one click.
GitHub Action that fails the PR when detection rule quality regresses. Ship detections like you ship code.
Start free. Upgrade when you want AI-generated fixes or team features.
For learning & one-off checks.
Solo detection engineers.
Detection teams, 3+ people.
20+ engineers, compliance-heavy.
Start for free. 20 analyses a month. No credit card.
Try DetectionLint →