Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the creation of PowerShell or batch scripts within the C:\ProgramData directory, which is a common location abused by malware for payload staging and persistence. The rule specifically looks for file creation events where the initiating process is cmd.exe or powershell.exe and the file extension is either .ps1 or .bat.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel for real-time document surveillance to steal files the moment they are modified.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
This rule detects suspicious post-exploitation activity originating from the BeyondTrust/Bomgar session process, `bomgar-scc.exe`. It identifies the execution of common Windows command-line interpreters and scripting environments (`cmd.exe`, `powershell.exe`, `pwsh.exe`, etc.) or the presence of specific command-line substrings indicative of privilege escalation, credential access, reconnaissance, lateral movement, defense evasion (like log clearing), or download/execution cradles. The rule assigns a risk score based on the detected activities and triggers an alert if the cumulative score and unique child process count exceed predefined thresholds, suggesting a high-confidence post-exploitation scenario.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.
Detects PowerShell command lines querying the HKCU:\Printers registry key and executing its contents via ScriptBlock creation. This technique is utilized by Gamaredon's GammaSteel malware for fileless registry staging and persistence.
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
Detects wscript.exe executing WMI queries targeting specific Win32 classes (such as Win32_SystemEnclosure, Win32_VideoController, etc.) to profile the host system. This behavior is associated with JS.MonoGlyphRAT, which extensively profiles systems before deploying secondary payloads.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects PowerShell script execution utilizing WMI event subscription (Register-WmiEvent) explicitly targeting the creation of logical disks with DriveType 2 (USB drives), a technique GammaSteel uses to steal data from physical media.
Detects PowerShell being executed with execution policy bypass and hidden window styles. This specific combination, particularly with the '-f' parameter, was utilized by the empty.vbs script to launch Profile.ps1 in the Dragon Weave campaign.
Detects wscript.exe (or cscript.exe) executing a JavaScript file from the C:\Users\Public\ directory. This behavior is indicative of the relocated JScript loader stage observed in a recent malspam .NET loader campaign.
Detects execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This campaign leverages malicious `*-setup.pth` files to download Bun and run an obfuscated JavaScript credential stealer.
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
Monitors the IIS worker process (w3wp.exe) for the execution of suspicious child processes such as cmd.exe, powershell.exe, and whoami.exe. This behavior is commonly associated with post-exploitation reconnaissance and execution via web shells, including those deployed during KnowledgeDeliver ViewState deserialization attacks.
Detects wscript.exe querying multiple Win32 WMI classes within a short timeframe to gather host telemetry. This behavior aligns with JS.MonoGlyphRAT's pre-payload execution profiling.
Detects PowerShell execution initiated by 'MicrosoftSystem64.exe' or 'MicrosoftSystem64' with specific command-line arguments (-NoProfile, -NonInteractive, -Command). This activity is indicative of the Node.js SEA RAT malware, associated with the DPRK-linked actor FAMOUS CHOLLIMA, attempting remote command execution.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This behavior is associated with the SStar Agent RAT's remote 'type' functionality.
Page 139 of 191