Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,008 detections
Filters
Last updated
All Time
Detection languages
1,930
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,437
11,828
5,871
5,150
4,864
4,008
Platforms
3,584
660
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,296
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects instances where wscript.exe deletes a .zip archive from within the C:\Users\Public\ directory structure. This activity is frequently associated with VBScript droppers performing anti-forensic cleanup by removing staged payloads after extraction but prior to execution.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
Detects potential malicious VBScript behavior where the script queries system language settings via WMI and subsequently launches a decoy message box commonly associated with initial-stage malware loaders or droppers to deceive users before initiating a payload download.
Detects instances where PowerShell, cmd, or mshta are launched as child processes of browser applications or Windows Explorer, often associated with 'ClickFix' or other social engineering attacks where a user is tricked into pasting malicious commands into the Windows 'Run' dialog. The rule identifies suspicious command-line arguments typical of downloader cradles or obfuscated scripts.
This rule detects scenarios where common web browsers (e.g., chrome.exe, msedge.exe) spawn known living-off-the-land (LotL) binaries (e.g., powershell.exe, wscript.exe, mshta.exe) with command-line arguments indicative of malicious activity, such as base64-encoded strings, hidden window flags, or remote script invocation (IEX/Invoke-Expression). This pattern is frequently used in drive-by download or phishing delivery chains where an initial payload is triggered directly from a browser context.
Detects instances where mshta.exe is launched from a web browser or explorer.exe with suspicious command-line arguments, such as remote URLs, script protocols, or potentially obfuscated/base64-encoded strings, often indicative of 'ClickFix' social engineering attacks.
Detects outbound web requests to the Telegram API triggered by Google Apps Script components (sidebar macros). This pattern is indicative of malicious Google Docs or Slides files using embedded scripts to exfiltrate data or perform command-and-control communication via the Telegram API when the document is opened by a user.
Detects the execution of the C# compiler (csc.exe) initiated by PowerShell. This behavior is often indicative of in-memory compilation and execution of malicious code, bypassing traditional file-based detection.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
Detects potential process injection attempts using PowerShell or CMD to execute memory manipulation operations. The rule identifies processes initiated in a suspended state that subsequently invoke Windows API calls such as WriteProcessMemory, NtUnmapViewOfSection, SetThreadContext, or ResumeThread, which are commonly associated with process hollowing or thread execution hijacking.
Detects the execution of piped curl-to-shell or curl-to-bash commands originating from a macOS Terminal process, a common pattern used in ClickFix-style social engineering attacks where users are tricked into copying and pasting malicious commands.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning common LOLBAS (Living Off the Land Binaries and Scripts) child processes. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used to execute shell commands or scripts for payload delivery or execution.
Detects instances where Python interpreters (python.exe or pythonw.exe) are executed from a subdirectory within ProgramData that matches a 32-hex character pattern, initiated by the 7zip archive utility (7za.exe). This pattern is indicative of a self-extracting archive or malicious installer unpacking and executing Python scripts in a stealthy, non-standard location.
Detects the execution of files related to 'UBPPatch' or 'HTSPnew', specifically looking for PowerShell scripts (.psh) or executables (.exe) that match these potentially non-standard or obfuscated update/patch filenames. The rule also looks for command lines referencing 'Update.Lst', often associated with custom or unauthorized patch mechanisms.
Detects the invocation of the C# compiler (csc.exe) by PowerShell, where the command line includes specific references to .cmdline files. This pattern is commonly used in fileless execution techniques to compile and execute malicious code in memory after delivery.
Detects the use of PowerShell script interpreters that utilize .NET runtime methods, such as 'RunspaceFactory' and 'CreateRunspace', to dynamically create and execute scripts, pipelines, or invoke methods. This technique is often used by fileless malware and offensive security tools to bypass traditional command-line logging by interacting directly with the System.Management.Automation assembly.
Detects signs of malicious activity involving specific files (StreamServiceSharedBridge.ps1, ComponentTask33Agent) and behaviors, including PowerShell execution, scheduled task creation, script execution via wscript, and registry run key modification. These behaviors are indicative of persistence mechanisms and potentially suspicious command execution.
Detects the execution of PowerShell scripts containing specific obfuscation or encoding patterns. The rule identifies potential malicious intent by searching for hardcoded suspicious strings or common binary-to-string conversion methods used to hide script content from security monitoring.
This rule detects potentially malicious command execution by monitoring additions to the Windows Explorer RunMRU registry key. It specifically triggers when the registry data contains references to 'powershell', 'curl', or appears to be encoded/base64 strings, which are often used by adversaries to execute malicious scripts or download payloads via the Run dialog.
This rule detects executions of the 'osascript' utility on macOS where the command line argument is exceptionally long and contains high entropy, suggesting the use of base64 or other encoding techniques to obfuscate malicious scripts or payloads.
Page 29 of 191