Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects modifications to common Windows Registry Run keys (Run, RunOnce, RunServices, RunServicesOnce) that include specific keywords ('ManageEngine', 'SystemOptimizer') and reference scripting tools ('wscript', 'cscript', 'powershell', 'cmd') in the RegistryValueData. This pattern is often used by adversaries to establish persistence on a system by ensuring their malicious scripts or commands are executed upon user login or system startup.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. These activities include PowerShell registry queries and process listing commands, indicative of potential malicious behavior.
Detects attempts to register an AppxPackage from a UNC path using PowerShell, which is a prerequisite for the UnCanny LPE/Coercion attack. This technique leverages the Add-AppxPackage cmdlet with the -Register parameter and a UNC path.
This rule detects automated script interaction with HR portals by correlating headless browsers or rapid HTTP POST requests sequentially navigating payroll endpoints. Specifically, it looks for network connections to URLs containing 'workday' or 'adp' initiated by 'python.exe' or 'curl.exe'.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, which could indicate a targeted phishing attempt or malware activity.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
Detects suspicious execution chains where common Windows scripting hosts (powershell.exe, cmd.exe, wscript.exe, etc.) spawn node.exe to run JavaScript files from user-writable directories (Temp, AppData, etc.). The rule flags execution patterns often associated with the TONResolver RAT, including specific PowerShell encoding or cryptography patterns and node.js scripts running from non-standard application paths.
Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.
Detects DNS queries for known TON blockchain related domains or rare top-level domains (shop, bond, sbs, cfd) initiated by common script interpreters or runtime processes like PowerShell, node, cmd, or wscript. This activity is often associated with the TONResolver, which may be used by malware for C2 communications, dead-drop resolution, or as a post-resolution staging mechanism.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, indicating potential malicious activity like phishing or malware delivery.
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.
This rule detects the execution of command-line scripts (specifically .bat files) located within the user's AppData\Roaming directory. It specifically flags execution attempts associated with 'xupdate.bat' or files containing 'Traiolx Custom Utils'. This activity is characteristic of malicious persistence or background utility execution often seen in various malware strains that attempt to camouflage their operation within user profile directories.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Detects instances where the WMI Provider Host (wmiprvse.exe) spawns common shell or script interpreter processes (cmd.exe, powershell.exe, cscript.exe, wscript.exe). This behavior is often indicative of fileless remote code execution used for lateral movement across Windows environments, as WMI is frequently abused by attackers to remotely trigger malicious commands.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
Page 104 of 191