Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects malicious usage of bcdedit.exe to weaken system boot security. The rule flags commands that disable Windows Recovery (WinRE), boot integrity checks, driver signature enforcement, or force legacy boot policies, which are often used by ransomware like TOKYOCORE to prevent system recovery and hinder defensive remediation.
Detects the creation of WMI event filters for the Win32_SystemStartup class via wmic.exe. This technique is used by the TOKYOCORE ransomware to achieve fileless, reboot-persistent execution by triggering malicious code when specific system events occur.
Detects the creation of a malicious Windows service named 'WinUpdateSvc' with the display name 'Windows Update Service Helper' using sc.exe. This activity is a documented persistence mechanism for the TOKYOCORE ransomware, which executes the binary 'fsociety.exe' with SYSTEM privileges.
Detects the creation of a suspicious scheduled task via schtasks.exe that masquerades as Windows Update or BootUpdate. The task is configured to execute 'fsociety.exe' with SYSTEM privileges upon system startup, logon, or boot, a behavior consistent with TOKYOCORE ransomware persistence and lateral movement.
Detects the use of bcdedit.exe to modify boot configuration data in a way that disables system recovery features, ignores boot failures, or bypasses integrity checks. This activity is often associated with ransomware or malicious persistence mechanisms aimed at preventing system recovery or loading unsigned drivers.
Generic rule content from file: Linux Privilege Escalation via Sudo/Wheel Enumeration and Setuid Ping6 Backdoor
Detects the use of vssadmin.exe to delete all volume shadow copies with the '/all' and '/quiet' flags. This technique is commonly employed by ransomware, including TOKYOCORE, to prevent system recovery by destroying backup snapshots prior to file encryption.
Detects the macOS ClickFix dropper chain where curl fetches a disguised Mach-O payload (winapp.bin/ZoomSDK.bin) within a process chain that also shows an osascript decoy dialog or a self-deleting shell script, consistent with BlueNoroff's fake meeting-app installer delivery.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects execution of the fscan internal network reconnaissance scanner renamed as sys.log or mail.log, or process command lines invoking the actual fscan CLI binary with its characteristic flags, as used by JadeProx operators for post-compromise internal network scanning.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects the Unicode RIGHT-TO-LEFT OVERRIDE character (U+202E) in process
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
Detects scripted use of the macOS 'security find-generic-password' command targeting the Chrome Keychain item from a shell or unsigned temp-directory parent process, consistent with BlueNoroff's post-ClickFix Keychain master-key theft technique.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects osascript executing AppleScript containing 'do shell script ... with administrator privileges' to elevate execution, where the osascript process was spawned by a non-shell parent process, consistent with the EtherHiding macOS loader technique.
Detects a specific attack chain where users are tricked into copying and pasting a malicious command (ClickFix) that downloads and executes a secondary stager named winPatch.zip via curl or wscript.exe, commonly associated with recent social engineering campaigns.
Detects mshta.exe being launched from explorer.exe or cmd.exe with a command line argument pointing to a remote HTTP/HTTPS resource ending in .hta. This pattern is commonly used by adversaries to execute malicious remote HTML applications for initial access or code execution.
Page 311 of 977