Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of PowerShell scripts containing specific obfuscation or encoding patterns. The rule identifies potential malicious intent by searching for hardcoded suspicious strings or common binary-to-string conversion methods used to hide script content from security monitoring.
This rule detects potentially malicious command execution by monitoring additions to the Windows Explorer RunMRU registry key. It specifically triggers when the registry data contains references to 'powershell', 'curl', or appears to be encoded/base64 strings, which are often used by adversaries to execute malicious scripts or download payloads via the Run dialog.
This rule detects executions of the 'osascript' utility on macOS where the command line argument is exceptionally long and contains high entropy, suggesting the use of base64 or other encoding techniques to obfuscate malicious scripts or payloads.
Detects the execution of command-line sequences associated with the second stage of ClickFix-style malware (often linked to AMOS or fake-Xcode campaigns). This rule looks for the concatenation of hex decoding (xxd), AES decryption (openssl), decompression (gunzip), and subsequent evaluation (eval) of a shell variable, which is a signature pattern for decrypting and executing malicious payloads in memory.
Detects execution of MeshAgent binaries when initiated by common scripting or application processes (e.g., java, sh, bash, python) or when displaying suspicious command-line patterns indicative of unauthorized remote access or download activity, particularly in environments like WebLogic or PeopleSoft.
This rule detects command-line activity where a remote resource is downloaded via 'curl', decoded using 'base64', and then piped directly into a shell interpreter (sh, bash, or zsh). This pattern is commonly used in fileless execution or stage-one payload delivery by attackers to execute malicious scripts directly from memory.
This rule detects suspicious outbound network connections originating from processes frequently abused in the Exvicy/ErrTraffic ClickFix malware delivery chain, specifically powershell.exe, msiexec.exe, and putty.exe. It also monitors for direct communication to known C2 IP addresses associated with the Exvicy threat actor, providing coverage for both the initial payload delivery and post-compromise C2 phases.
Detects malicious JavaScript/npm payloads that attempt to evade static analysis and string-based detection signatures by dynamically reconstructing sensitive strings at runtime using V8 string-object construction or obfuscated string tables.
Detects Node.js processes executing suspicious command lines that involve fetching and executing remote JavaScript code. This behavior is indicative of a loader or downloader script commonly used to pull and evaluate malicious payloads at runtime, specifically referencing indicators associated with 'GHAPPIER'.
Detects the execution of mshta.exe with suspicious command-line arguments that indicate the loading of remote HTML Applications (HTA) via URLs or inline scripts (javascript/vbscript). This behavior is often indicative of fileless malware execution and living-off-the-land techniques to bypass security controls.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI). This rule monitors for command-line arguments indicative of reflection-based patching of AmsiUtils and forced AmsiScanBuffer failures, as well as registry modifications to AMSI providers.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
This rule monitors for suspicious PowerShell command-line activity originating from Windows Explorer (explorer.exe) or embedded within RunMRU registry modifications. It detects obfuscated or hidden command execution patterns, such as base64 encoding, the use of -EncodedCommand, Invoke-Expression, or execution policy bypass flags, which are commonly associated with malicious scripts and fileless malware execution.
Detects the presence of the malicious 'indexed-btree' npm package, which contains a backdoor that hooks 'BTree.prototype.set' to execute 'sharedLoad.min.js' at runtime. The rule monitors for characteristic file paths, function hooking patterns, and node process spawning behavior designed to evade installation-time static analysis.
Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
Detects the 'sharedLoad.min.js' loader script associated with the malicious 'indexed-btree' npm package family. This script utilizes X25519 ECDH for key exchange and AES-256 decryption to retrieve and execute a second-stage payload hosted on a Sepolia smart contract.
Detects Node.js processes executing command lines containing known malicious indicators or accessing specific suspicious JavaScript files (e.g., sharedLoad.min.js) associated with malicious loaders or hardcoded cryptographic keys.
This rule detects potentially malicious child processes spawned by Visual Studio Code (Code.exe) when using VS Code tasks (tasks.json). It identifies suspicious CLI arguments often associated with downloading, executing, or obfuscating scripts (e.g., PowerShell, curl, python, mshta) that are not part of standard development workflows like npm, yarn, or git, which are explicitly filtered out as noise.
Detects the execution of mshta.exe by explorer.exe with command line arguments containing script protocols (javascript:, vbscript:) or remote URLs. This is a common technique used by attackers to execute malicious HTA files or inline scripts, bypassing security controls.
Detects the execution of mshta.exe by explorer.exe with command line arguments containing script protocols (javascript:, vbscript:) or remote URLs. This is a common technique used by attackers to execute malicious HTA files or inline scripts, bypassing security controls.
Page 30 of 191