Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the creation or modification of a .vscode/tasks.json file, followed by the execution of a process (specifically node.exe) that targets a script file without a standard JavaScript extension (.js, .mjs, .cjs). This behavior is consistent with an adversary configuring a hidden VS Code task (e.g., using 'hide:true' and 'runOn:folderOpen') to silently execute arbitrary code or assets when a project folder is opened.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.
Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.
Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.
Detects suspicious behavior originating from Windows Package Manager (winget.exe) and associated DSC/Server processes. This rule identifies two specific patterns: 1) These processes spawning shells or interpreters (e.g., PowerShell, cmd, mshta) which may indicate command-line abuse or malicious script execution. 2) These processes making outbound network connections to non-private/external IP addresses, potentially indicating remote payload delivery or command and control activity.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects the execution of Node.js where the command line arguments reference a .woff2 font file. This behavior is indicative of an adversary attempting to execute a malicious payload disguised as a legitimate font file, a technique previously associated with the PolinRider campaign.
This rule detects potentially malicious activity where a web browser (e.g., Chrome, Edge, Firefox) spawns suspicious child processes (e.g., mshta.exe, wscript.exe) with command-line arguments that include indicators of script execution, remote code download, or command invocation, which is a common pattern in drive-by download attacks and malicious link execution.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects execution of OfficeUpdater VBScript via wscript.exe or cscript.exe with specific command line arguments, or the creation of corresponding .ini configuration files. This pattern is indicative of potential malicious activity or persistence mechanisms mimicking legitimate update processes.
This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.
Detects wscript.exe or cscript.exe executing VBScript to query WMI classes (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor) or 'Basic System' information. This activity is often used for host reconnaissance and fingerprinting by threat actors prior to C2 check-in, notably observed in Kimsuky multi-stage tradecraft.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.
Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.
Page 67 of 191