Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of a malicious Node.js payload by the TONResolver malware. The rule monitors for the execution of node.exe from a specific path within the user's AppData directory (AppData\Local\Nodejs\node-v24.13.0-win-x64\) when accompanied by a JavaScript file argument, indicating the execution of a remote access trojan (RAT) script.
Detects the use of .NET reflection within PowerShell to resolve and invoke native Windows APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx) typically used by the GIFTEDCROOK actor to perform in-memory shellcode or PE loading. The rule searches for command line patterns combining native API names with reflection-related keywords.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.
This query hunts for malicious scripts that are logged on Crowdstrike EDR telemetry via the event type: ScriptControl
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
Detects instances where the Visual Studio Code process (code.exe) spawns shell or scripting interpreters (such as cmd.exe, powershell.exe, python.exe, etc.) to execute commands involving sensitive file paths, development configuration files, or suspicious keywords, specifically within a short duration (5 minutes) after Git or NPM activity has occurred on the same host. This pattern may indicate exploitation or unauthorized code execution triggered through a compromised or malicious development environment.
Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.
Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.
Detects node.exe spawning cmd.exe or powershell.exe during npm package installation process, indicating potential malicious use of preinstall or postinstall scripts. This pattern has been observed in supply chain attacks involving infostealers like Miasma and MYRA.
Detects the execution of Python scripts on Windows that utilize keyboard hooking libraries or APIs (pynput, GetAsyncKeyState, SetWindowsHookEx) characteristic of keylogging behavior. The rule specifically excludes known development environments to reduce false positives.
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects malicious .jse loader scripts associated with Kimsuky's NUKESPED malware family. The rule identifies suspicious behaviors including the creation of Scripting.FileSystemObject for filesystem manipulation, use of GetSpecialFolder for staging, and file system enumeration via GetFile, which are key components of the threat's payload delivery and staging process.
Detects the deletion of executable or script files (e.g., .dll, .exe, .bat, .jse) from temporary directories using common command-line utilities like cmd.exe or scripting hosts. This behavior is often associated with malware (such as Kimsuky loaders or JFMBackdoor) attempting to remove dropped artifacts to evade forensic analysis.
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects the abuse of the Windows utility mshta.exe to execute potentially malicious scripts or remote HTML applications (HTA). The rule looks for command-line arguments involving remote URL fetches (HTTP/HTTPS/UNC) or inline script execution (vbscript/javascript), which are common techniques for bypassing security controls and executing payloads.
Page 70 of 191