Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Detects the use of the 'Add-Type' cmdlet in PowerShell to compile and load C# code directly into memory. This technique is used by the TAMECAT backdoor to pivot from PowerShell to C# modules for tasks like exfiltration and browser data theft, bypassing file-on-disk scanning.
Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.
Detects the execution of automated Nginx configuration modification scripts by identifying the use of 'csplit', 'awk', or 'sed' in close proximity to Nginx service management commands (reload, restart, or testing). This pattern is a hallmark of the 'bt.sh', 'zdh.sh', and '4zdh.sh' toolkits used to inject malicious proxy_pass directives.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, where an embedded OLE object leads to code execution.
Detects Windows VBScript processes (wscript.exe or cscript.exe) performing DNS queries for AI/LLM API domains. This behavior is a key indicator of malware like PROMPTFLUX and WormGPT, which leverage these APIs for dynamic code generation and evasion. This activity is highly suspicious as VBScript engines rarely perform external network operations to these types of services. Sysmon event id 22 is the best way to detect this behavior on endpoints.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, such as CVE-2026-21509, where an embedded OLE object leads to code execution.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects when a suspicious process (such as a script interpreter or LOLBIN) is executed from a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious executables or scripts in these locations to bypass security controls and execute them, often as a result of a user opening a malicious document.
Detects PowerShell scripts attempting to perform image steganography by loading System.Drawing assemblies and calling functions like GetPixel or LockBits to extract data. This technique was observed in an Amatera Stealer campaign where payloads were hidden in PNG files hosted on public CDNs.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a suspicious child process (like cmd.exe or powershell.exe) from a document located in a configured Office Trusted Location. While trusted locations are meant to bypass macro security warnings, the subsequent spawning of shell processes is a strong indicator of malicious macro execution for post-exploitation activities.
Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects the execution of the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs' by a script host like wscript.exe or cscript.exe. This technique is used as a LOLBIN to proxy execution of other code, such as PowerShell, bypassing detections that focus on direct PowerShell execution or common parent-child process relationships. This was observed in a campaign delivering Amatera Stealer.
Detects the execution of SyncAppvPublishingServer.vbs via wscript.exe or cscript.exe. This legitimate Windows script can be abused by adversaries to proxy execution of malicious PowerShell commands, bypassing execution restrictions and evading defensive measures.
Detects the execution of SyncAppvPublishingServer.vbs with a command line containing a semicolon, which is indicative of the ClearFake malware campaign's ClickFix technique. This technique abuses SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands, often delivered via social engineering involving malicious copy-paste actions.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Page 156 of 191