Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.
This rule detects instances where Windows file sharing-related processes, specifically NearShareReceive.exe, QuickShare.exe, or nearshare.exe, spawn command-line or scripting interpreters such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This activity is indicative of potential malicious file execution where an adversary leverages built-in sharing features to deliver and execute payloads.
Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.
Detects the execution of mshta.exe from common initial access vectors like document viewers (WinRAR), web browsers (Outlook, Thunderbird), or the Windows Shell (explorer.exe). Additionally, detects instances where mshta.exe subsequently spawns wscript.exe or cscript.exe, which is indicative of a multi-stage script execution chain often used to execute malicious payloads.
Detects suspicious execution of scripting hosts (wscript.exe, cscript.exe, mshta.exe) that are commonly leveraged by the Gamaredon threat group. The rule specifically flags VBScript/HTA execution originating from temporary directories and monitors for the creation of persistence via Windows Registry Run keys.
This rule detects execution patterns associated with the Gamaredon (Shuckworm) group's Ptero-family of malware. It specifically monitors for encoded PowerShell commands, the use of Invoke-Expression, and the execution of mshta.exe or wscript.exe spawned by Office applications or email clients, which is characteristic of Gamaredon's HTML smuggling and malicious document delivery techniques.
Detects node.js executing known malicious npm lifecycle scripts (such as install-check.cjs, verify-peer.cjs, sync-peer.cjs, postinstall-run.js, and preinstall.js) often found in node_modules folders. These scripts are associated with the Polymarket Trap supply chain campaign, which leverages malicious npm hooks for initial access or malicious activity within a development environment.
Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
Detects wscript.exe executing PowerShell to run a script dropped into the C:\Temp directory. This behavior is consistent with common JScript dropper infection chains, such as Amadey or StealC, which use WScript to decode and execute Base64 payloads from temporary files using hidden windows and bypassed execution policies.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Page 102 of 191