Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of VBScript, JavaScript, or HTA files via cscript.exe or wscript.exe when the script file originates from suspicious locations such as AppData, Temp, or via URL/network paths. The rule filters out scripts launched by known trusted publishers to minimize noise from legitimate system or application activity.
Detects the abuse of the Windows Package Manager (winget) Desired State Configuration (DSC) engine, where winget configure processes spawn configuration remoting or package manager server binaries. This behavior often indicates the execution of embedded PowerShell scripts or remote configuration files via YAML-based DSC configurations, which can be leveraged for malicious code execution.
Detects WScript.exe performing multiple registry queries against sensitive Windows Classes and file association keys. This pattern of behavioral profiling is consistent with Kimsuky's NUKESPED downloader or JSE loader identifying system configuration before payload execution.
This rule detects command-and-control (C2) communication patterns associated with the Kimsuky threat group (specifically NUKESPED malware). It identifies network traffic to specific Fastly CDN IP addresses or domains related to the National Health Insurance Service (nhis.or.kr) originating from known malicious or suspicious execution processes like wscript.exe, cscript.exe, powershell.exe, or zlrenu8.exe.
Detects the execution of JScript Encoded (.jse) files via wscript.exe or cscript.exe when spawned by Office applications or email clients. This pattern is indicative of Kimsuky initial stage payloads, where a malicious lure file is dropped into a user-writable directory (e.g., Temp, AppData, Downloads) and subsequently executed.
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
Detects malicious activity associated with the Kimsuky NUKESPED campaign, specifically the execution of .jse droppers from the Downloads directory using Windows Script Host (wscript.exe/cscript.exe), execution of known malicious files by SHA256 hash, and the presence or creation of the associated zlrenu8.exe payload.
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects anomalous registry activity by wscript.exe, specifically targeting keys associated with file association, COM object registration, or run-time startup locations. A high count of registry open operations by a scripting engine often indicates persistence installation or reconnaissance of system configuration.
Detects PowerShell activating the internal Store install-control class required for UnCanny coercion. This technique is associated with the UnCanny coercion method, which leverages a COM object to achieve privilege escalation or other malicious activities.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.
This rule detects potentially suspicious process activity where unknown or infrequently seen processes spawn common script interpreters such as cmd.exe, powershell.exe, wscript.exe, or others. This behavior often indicates an attempt to execute malicious commands or scripts as part of a post-exploitation or persistence mechanism.
Detects instances where browser processes (Chrome, Edge, Firefox) directly spawn PowerShell or MSHTA. This is a behavioral indicator of the 'ClickFix' social engineering technique, where victims are tricked into copying and pasting malicious commands into a terminal, often presented as 'fixes' for fake browser error messages or verification prompts.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects the execution of mshta.exe with a .hta file path located in common user-writable directories (Temp, Downloads, AppData, User Profile) accompanied by suspicious filename themes often associated with phishing or social engineering, such as military, salary, or diplomatic lures.
Page 100 of 191