Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the malicious Terminal execution sequence where base64 encoded text is piped into bash to fetch the first-stage AMOS script.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
Detects a highly suspicious process ancestry where a web browser directly spawns a scripting engine, indicative of exploited browser vulnerabilities or aggressive drive-by execution.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects the dropping of reverse proxy binaries (like Ngrok or Cloudflare tunnel daemons) by PowerShell, which could be used to expose internal Terminal Services to the internet. This activity is often associated with phishing campaigns targeting Terminal Servers.
This rule detects the spawning of common command-line interpreters, utilities, and scripting engines by a parent process associated with 'autogenstudio'. This behavior is potentially indicative of command injection or exploitation where an AI-driven development environment is leveraged to execute unauthorized system commands or launch malicious payloads.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.
Detects the execution of cmd.exe or powershell.exe where the command line contains references to the Avast directory. This behavior may indicate an attempt to tamper with, interact with, or bypass security software components.
Vidar In Memory Assembly
YARA-L
Identifies PowerShell dynamically converting the extracted Base64 string into bytes and loading it directly into memory.
Identifies PowerShell dynamically converting a Base64 string into bytes and loading it directly into memory, a technique often used by malware like Vidar for reflective code loading.
Detects execution of PowerShell commands using WScript.Shell to create shortcuts, specifically looking for indicators related to 'vile_Decryptor.lnk' or 'vile_icon.ico'. This pattern is frequently observed in malware deployment or dropper activities aiming to establish persistence or facilitate user-driven execution.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects anomalous child process creation from the Lunar Minecraft Client or its associated Java processes (java.exe/javaw.exe). This rule identifies potential supply-chain exploitation, where malicious mods or the client itself spawn shell interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) or other suspicious binaries from the application's directory, which is characteristic of the lunar-modrinth-chain-poc exploit.
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
Detects mshta executing a remote HTA, JavaScript, or HTML resource from a browser-driven installation chain. This rule specifically looks for mshta.exe being executed with a command line containing a URL (http/https) or script protocol (javascript/vbscript) followed by file extensions or keywords commonly associated with malicious scripts or payloads (.hta, .js, .html, payload, install).
Detects the execution of known enumeration shell scripts (opsec_enum.sh, oops_enum.sh) using common Unix command interpreters (bash, sh, dash). These scripts are commonly used by threat actors during the post-exploitation reconnaissance phase to gather system or environment information.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
This rule detects potential persistence mechanisms by monitoring modifications to specific Windows registry keys. It looks for the creation or modification of 'Image File Execution Options' (IFEO) debugger keys, which can be used to hijack process execution, and specific 'Run' keys that could be used for unauthorized startup execution. The rule focuses on these activities when initiated by script interpreters like wscript.exe or cscript.exe.
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Page 114 of 191