Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
This rule detects suspicious usage of Windows Script Host (wscript.exe or cscript.exe) by monitoring for the execution of VBScript files containing keyword-heavy command lines related to common phishing themes (e.g., 'Invoice', 'Payment', 'Urgent'). It flags when a specific device executes three or more such scripts within a one-hour window, which is indicative of potential bulk file processing or automated malicious activity typical of dropper or downloader malware.
Detects multiple executions of WScript.exe or CScript.exe within a single hour on the same device where the command line arguments contain document-related keywords such as Invoice, Bill, or Payment, and the file extension ends in .vbs or .vbe. This pattern often indicates mass execution of malicious scripts often delivered via email attachments or phishing lures.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
Detects execution of a Brazilian invoice-themed batch file that launches hidden PowerShell and stages the banking trojan. This rule specifically looks for process creation events where the executable is 'cmd.exe' or 'powershell.exe' and the command line contains 'Consultar_NF-e.bat' or similar variations, indicating the use of a batch file named after a Brazilian invoice.
Detects the batch stager iterating through all possible drive letters to locate the mounted USB/ISO drive containing the hidden payload. This rule specifically looks for 'cmd.exe' processes executing a command line that includes a 'for' loop iterating through drive letters A through G.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
Detects the execution of osascript used to generate deceptive "Network latency" GUI prompts, tricking the user into granting TCC permissions.
Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.
Detects the secondary PowerShell stage explicitly downloading and writing the client32.exe NetSupport Manager RAT binary to disk. This rule identifies instances where a file named 'client32.exe' is created on a device, and the process responsible for this file creation is PowerShell.
Detects PowerShell executing the Add-MpPreference cmdlet specifically excluding the targeted mining executables (RuntimeHost.exe, lolMiner.exe, gminer.exe). This activity is indicative of an attacker attempting to disable or bypass Windows Defender's real-time protection for known cryptomining executables, a common tactic in cryptojacking campaigns.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects the execution of PowerShell commands or script blocks that contain specific de-obfuscation patterns associated with the ErrTraffic/ClickFix malware. It looks for the presence of '-bxor' and '[convert]::ToInt32' within PowerShell command lines or script blocks, indicating an attempt to decode obfuscated content.
Detects the ClickFix clipboard execution (Get-Clipboard or iex) triggered from explorer.exe, specifically leading to the download of the Matanbuchus DLL.
Detects execution of VBScript files that may be malicious
Detects PowerShell IEX download cradle used for fileless execution
Detects the creation of files with names containing 'winPatch' and extensions of '.zip' or '.vbs' in Windows TEMP directories, originating from PowerShell or WScript processes. This behavior is indicative of potential ingress tool transfer or staging of malicious scripts.
Detects indicators of execution related to a known NPM Remote Access Trojan (RAT), including masquerading via chost.exe, execution from specific temporary directories used by the malware, and Python scripts executing a loader.py file from temporary locations.
Page 106 of 191