Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects the use of PowerShell to perform reflective assembly loading of a payload that has been decrypted using AES and decompressed with GZip. This pattern is commonly used by attackers to load malicious .NET assemblies directly into memory while bypassing static file-based detection.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects osascript process execution spawned by launchd/LaunchAgent chains where the invoked AppleScript command line contains obfuscated/encoded content, consistent with EtherHiding's Launch Agent-triggered AppleScript payloads used to query blockchain C2 infrastructure.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects the use of PowerShell to perform reflective assembly loading of a payload that has been decrypted using AES and decompressed with GZip. This pattern is commonly used by attackers to load malicious .NET assemblies directly into memory while bypassing static file-based detection.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.
Detects instances where 7-Zip utility processes (7z.exe, 7zFM.exe, 7zG.exe) or DLLs act as the parent for suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or other binaries running from temporary or download directories. This pattern is commonly associated with the execution of malicious payloads extracted or staged via 7-Zip archives.
Detects lateral movement patterns involving PsExec or PSEXESVC where either a suspicious command-line flag (e.g., '-psex') is present or the PsExec service spawns child processes like cmd.exe or powershell.exe executing suspicious, obfuscated, or remotely retrieved payloads.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects instances where the Windows Explorer process (explorer.exe) spawns common script interpreters or command-line tools such as PowerShell, cmd.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior is atypical for normal user activity and is frequently associated with malicious activity, including post-exploitation, code execution, or defense evasion.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects the execution of JScript files via wscript.exe where the file name follows the 'wupd_' naming convention. This pattern is characteristic of LabubaRAT, which drops obfuscated or malicious scripts with this prefix to execute them using the Windows Script Host.
Detects the use of mshta.exe to execute code directly from a remote URL that includes a numeric path segment. This behavior is often associated with the retrieval of HTA, VBScript, or JScript payloads from attacker-controlled servers, where the numeric path may indicate a versioned payload or a specific exploit delivery mechanism.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects the execution of a specific batch script named 'C:\hello.bat' using the Windows Command Shell (cmd.exe). The presence of this specific script name is considered highly anomalous and potentially indicative of malicious activity or a dropped payload.
Page 61 of 191