Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.
Detects the use of mshta.exe to execute code directly from a remote URL that includes a numeric path segment. This behavior is often associated with the retrieval of HTA, VBScript, or JScript payloads from attacker-controlled servers, where the numeric path may indicate a versioned payload or a specific exploit delivery mechanism.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Detects indicators of the Miasma worm compromise on Windows and macOS systems. This includes the execution of malicious Spectral CLI payloads from npm npx cache directories, the staging and execution of sync.js payloads, the creation of Miasma-specific lock files and Cryptnet cache artifacts, and persistence established via Windows Registry Run keys.
Detects the execution of the Stoplight Spectral CLI tool from within the temporary npm/npx cache directory structure on Windows endpoints. This behavior is associated with supply-chain attacks, where malicious packages exploit npx cache paths to execute unauthorized code. The rule accounts for both fixed cache identifiers observed in specific campaigns and generalized paths used by npx, while excluding benign Playwright test executions.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.
Detects the execution of PowerShell via mshta.exe or wscript.exe, specifically when the command line includes encoded commands. This is a common pattern for attackers using living-off-the-land binaries to execute obfuscated malicious payloads, bypassing basic security controls.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
This rule detects execution chains associated with the Quima RAT loader, specifically monitoring for VBScript-based child processes spawning suspicious command-line activity. This includes the use of certutil.exe to decode payloads, discovery commands like 'where javaw', and the execution of suspicious Java processes with specific arguments or paths indicative of malicious behavior.
Detects Blind Eagle JC-46 VBScript/JScript loader obfuscation toolmarks: zv-prefixed self-mutating XOR decryptor with 0xE0 key, junk arithmetic index shuffle, custom RC4-like stream decoder, custom AES S-box/RCON with 0xA5 mask, Wales() decimal decoder, Base28 alphabet, and oversized VBScript droppers
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects the execution of PowerShell scripts associated with unauthorized Active Directory information gathering. This includes the execution of specific scripts from ProgramData and the logging of known reconnaissance commands or script contents within PowerShell event logs.
Detects PowerShell script block execution containing patterns associated with network discovery, specifically splitting IP strings and calculating /24 subnets, often indicative of host or network reconnaissance.
Detects obfuscated PowerShell scripts that combine randomized long variable names with synthetically generated no-op or dead loop structures, a common technique to evade signature-based detection and increase analysis time.
Page 62 of 191