Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects activity associated with Operation Poisson credential theft, specifically the use of VBScript (sys.vbs) to launch a Python keylogger (pynput or keyboard library) or the installation of keylogger dependencies via pip. It also includes a hash match for a known artifact (KeyL.zip).
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Identifies untrusted AutoHotkey (AHK) scripts executing under renamed benign system signatures, specifically masquerading as Realtek components.
Detects Python processes executing from suspicious locations like AppData or Temp folders that also establish outbound network connections. This behavior can indicate the execution of malicious Python scripts, often associated with malware, initial access, or command and control activities.
Detects PowerShell scripts that reconstruct native cmdlets (e.g., Test-Path) from fragmented character arrays mapped to Simplified Chinese variables, a technique observed in AsyncRAT campaigns for obfuscation.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
Detects AutoGen Studio spawning interactive Windows shells (cmd, powershell), indicative of the AutoJack exploit.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.
Detects generic instances of scripting languages (Python/PowerShell) leveraging anomalous named pipes (e.g., PipePipe!, postex) to inject or execute shellcode directly in memory.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
This rule detects inbound Remote Desktop Protocol (RDP) connections (ports 3389, 3390, 3391) that are initiated by common scripting engines such as wscript.exe, cscript.exe, or powershell.exe. This behavior can be indicative of post-exploitation activity where an attacker uses scripts to establish remote access.
Detects pythonw.exe execution specifically invoked by cmd or powershell from the AppData directory. This behavior is often associated with malicious Python loaders used in social engineering campaigns leveraging AI hype.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
This rule detects suspicious execution patterns involving 'wscript.exe' or 'cscript.exe' that utilize common COM objects or VBScript, while excluding executions from standard Windows and Program Files directories. It specifically looks for multiple unique command line executions within a two-hour window from the same device and account, indicating potential malicious script activity.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects a shell script containing 'fanout' in its name, created or modified in common temporary directories like /tmp or /var/tmp, matching a reported propagation workflow. This activity is indicative of lateral movement attempts.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
This rule detects suspicious command execution patterns on Linux systems that could indicate an adversary attempting to execute arbitrary commands or escalate privileges. It looks for specific command-line arguments used with common utilities like `find`, `vim`, `python`, `perl`, `bash`, `awk`, and `cp` that are often abused for malicious purposes. The rule also excludes processes commonly associated with legitimate system automation to reduce false positives.
Page 112 of 191