Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
Detects the use of 'osascript' to execute AppleScript-based dialog boxes designed to trick users into providing credentials or mimicking system administration prompts. These scripts use labels often associated with fake security or permission requests to harvest passwords.
Detects instances where the WLDR Agent attempts to execute code via 'Start-ModuleJob' and subsequently hits an error condition, forcing a fallback to native PowerShell 'Start-Job' cmdlets. This pattern of falling back from a specialized execution environment to standard, potentially less-monitored, background jobs can indicate an attempt to bypass existing runspace restrictions or execution policies.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects the execution of macOS command interpreters (osascript, sh, bash, zsh) where the command line arguments reference specific timezones (e.g., Moscow, Minsk) or locale settings (e.g., RU, BY, KZ, AM, AZ). This pattern is often associated with adversary attempts to detect or evade sandbox environments based on regional settings or to align with specific target geographic profiles.
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects the execution of an AppleScript file via the osascript utility that initiates a network connection within a 5-minute window of execution. This behavior is often indicative of automated script-based network activity, such as command-and-control communication or data exfiltration.
Detects PamStealer's embedded helper binary dropped to /private/tmp/System Settings and used to establish legacy login item persistence via osascript System Events
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Detects a suspicious execution chain where hh.exe (HTML Help) launches wscript.exe, which then executes certutil.exe, followed by the launch of powershell.exe. This pattern is commonly associated with Living-off-the-Land (LotL) techniques to execute malicious scripts or payloads, often used to bypass security controls or fetch remote files.
Detects instances where Windows Explorer (explorer.exe) spawns common command-line interpreters (powershell.exe, mshta.exe, cmd.exe) with suspicious command-line arguments indicative of fileless execution, obfuscation, or remote payload retrieval.
Detects the persistence and execution mechanism of ChocoPoC RAT, where a Python interpreter is spawned in a hidden window using the CREATE_NO_WINDOW flag (0x08000000). The rule monitors command-line arguments and parent-child process relationships for indicators of the RAT's module import, specific environment variables used for anti-recursion loops, and process spawns originating from existing Python instances.
Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.
Detects the execution of a VBScript file using wscript.exe, where the script is located in the user's Startup folder. This pattern is commonly used by malware to maintain persistence by ensuring the script executes automatically upon user logon.
Detects the execution of Microsoft HTML Help (hh.exe) loading a .chm file, which subsequently spawns common command-line interpreters like cmd.exe, powershell.exe, or wscript.exe. This pattern is commonly used in phishing attacks to bypass security controls and execute malicious payloads.
Page 65 of 191