Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of PowerShell or Command Prompt initiated by Windows script interpreters (wscript.exe, cscript.exe) that contain command-line arguments indicative of malicious activity. This includes commands related to raw disk access, system recovery inhibition (e.g., shadow copy or backup catalog deletion), and boot configuration manipulation often associated with ransomware or wiper activity.
Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.
Detects the execution of Windows system recovery manipulation commands (vssadmin, wbadmin, or bcdedit) initiated by script interpreters (wscript.exe, cscript.exe). This pattern is commonly observed in malware and ransomware campaigns attempting to prevent system recovery.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.
Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.
Detects unauthorized modifications to the Image File Execution Options (IFEO) registry keys for 'cmd.exe'. The rule specifically looks for the 'Debugger' value being set to script-based interpreters (e.g., .vbs, .js, wscript, cscript), a technique known to be used by LCRYX ransomware to intercept security tool execution and establish persistence.
Detects the execution of Windows recovery-inhibiting commands (shadow copy deletion, backup catalog deletion, and boot recovery policy modification) originating from wscript.exe, a behavior commonly associated with the LCRYX ransomware family.
Detects highly obfuscated VBScript execution utilizing specific array splitting and character decoding loops used by GammaDrop. The rule specifically looks for the combination of 'Split' and 'ChrW' functions within VBScript command execution, which is indicative of a common obfuscation technique used by the Gamaredon APT group.
Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.
Detects PowerShell processes searching for .docx and .txt files in cloud sync directories.
Detects developers pasting malicious PowerShell one-liners from fake install pages.
Detects Chrome extension package files associated with the 'BadBlocker' Adblock for YouTube campaign, identifying malicious indicators such as specific remote fetch logic ('scripletsRules'), Unistream SDK integration, and execution patterns that abuse browser extension functionality to bypass security controls or fetch remote content.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
Detects execution of scripts using exact names mapped to the AsyncRAT infection chain. These script names are associated with malicious activity often disguised as legitimate Realtek audio components.
This rule detects a specific kill chain involving PowerShell executing ClickFix, followed by rundll32 loading Matanbuchus, and finally, an AstarionRAT executable running from the AppData folder. The detection logic links these events by device ID and within specific timeframes (5 minutes between ClickFix and Matanbuchus, and 10 minutes between Matanbuchus and AstarionRAT).
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Identifies scripts or commands iterating through logical drives specifically searching for sensitive file extensions (.kdbx, .pdf, .docx, .xlsx, .txt) and then creating a text file, indicating potential data staging prior to exfiltration.
Detects the use of 'curl' to download content that is then directly piped to a shell interpreter (bash, sh, zsh). This technique is often used for fileless execution, where a malicious script is executed without being written to disk, as noted in the context of initial Miasma stages.
Page 115 of 191