Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
Detects instances where common Windows system processes (dllhost.exe, mmc.exe, svchost.exe) spawn known living-off-the-land binaries (LotLBin) or command-line interpreters. This behavior is often indicative of process injection or malicious activity where an adversary leverages trusted system processes to execute commands or malicious scripts.
Detects the execution of mshta.exe with suspicious command-line arguments, including the use of 'javascript:', 'vbscript:', or HTTP/HTTPS URLs. These patterns are commonly used to proxy the execution of malicious HTML Applications (HTA) or scripts to bypass security controls. The rule includes an exclusion for legitimate Microsoft-signed mshta.exe processes that do not contain these suspicious indicators.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) initiates potentially suspicious child processes often associated with lateral movement or remote command execution, such as command shells, scripting interpreters, or binary execution utilities.
Detects the execution of mshta.exe with arguments containing URLs, script languages (vbscript, javascript), or .hta file extensions, which is a common technique used by attackers to execute malicious code via a legitimate Windows utility.
Detects the execution of script files (.vbs, .js, .wsf) using Windows script hosts (wscript.exe, cscript.exe) from common user-writable directories such as Temp, Downloads, and AppData. This behavior is often indicative of malicious files being dropped by phishing attachments or drive-by downloads and subsequently executed by an adversary.
Detects node.exe spawning PowerShell, a technique used by the MuddyWater (also known as Seedworm) threat group for post-exploitation reconnaissance, staging, and screenshot capture. This rule specifically looks for the 'node.exe' process initiating 'powershell.exe' or 'pwsh.exe'.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
Detects the use of legitimate scripting utilities (curl, wget, powershell) to download files into common, potentially writable, or temporary directories (Temp, AppData, ProgramData, Downloads). The rule specifically excludes files that are digitally signed by trusted publishers.
Detects execution of the EDRUnChoker remediation tool, useful for situational awareness. This rule specifically looks for the command line containing 'Install-EdrChokerWmiDefense.ps1', indicating the execution of a PowerShell script related to EDR evasion or manipulation.
Identifies rapid creation of multiple QoS policies, matching EDRChoker's behavior iterating through process lists. This rule detects when three or more QoS policies are created within a one-minute window on a single device, indicated by the execution of 'New-NetQosPolicy' via PowerShell.
Detects suspicious installation attempts of ManageEngine Endpoint Central (ADSelfService.exe) potentially associated with Prinz Eugen ransomware. The rule looks for silent installation parameters or execution initiated by PowerShell or Cmd.exe, which could indicate malicious deployment.
This rule detects VBScript execution (via wscript.exe or cscript.exe) that attempts to load WinHTTP objects (WinHttpRequest.5.1, MSXML2.XMLHTTP) or uses generic object creation functions (CreateObject, GetObject). This behavior is often associated with VBScripts establishing command and control (C2) communication or performing data exfiltration.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Page 110 of 191