Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects network connections from common browser processes and script execution engines to the known Payroll Pirate (Storm-2755 / Storm-2657) phishing domain 'bluegraintours.com', which is associated with Adversary-in-the-Middle (AiTM) session cookie and OAuth token harvesting.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.
Detects the execution of wscript.exe as a child process of hh.exe (the Microsoft HTML Help executable). This behavior is often associated with the execution of malicious scripts embedded within CHM files, which is a common technique for bypassing security controls and executing arbitrary code.
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects web browsers or file explorer spawning common script interpreters (PowerShell, CMD, mshta, etc.) with command-line arguments indicative of malicious activity, such as encoded commands, Base64 strings, or web-based script downloads, typical of ClickFix or similar browser-based social engineering attacks.
Detects the use of PowerShell .NET reflection to access non-public static fields within the System.Management.Automation.AmsiUtils class. Attackers often target fields such as 'amsiInitFailed' or 's_amsiContext' to programmatically disable or bypass Antimalware Scan Interface (AMSI) inspection during script execution.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user, aiding in defense evasion.
Detects the use of PowerShell to silently download and install a Remote Monitoring and Management (RMM) tool, identified by common RMM executable names and silent installation parameters.
Detects various reconnaissance and discovery commands, including process listing, registry queries, and security software enumeration, that are characteristic of the SystemBC malware's in-memory scripting behaviors. The rule identifies suspicious process parent-child relationships, unauthorized registry queries of sensitive security paths, and the use of command-line tools like WMIC, Tasklist, and PowerShell for environment discovery without disk-based script artifacts.
This rule detects activities related to the 'Exploitarium' DLX exploit proof-of-concept (PoC) toolkit. It monitors for the invocation of 'objdump' with specific flags used in these exploits, the presence of associated Python and shell scripts on the filesystem, and the spawning of suspicious child processes (like command interpreters or calculators) by 'objdump', which acts as an indicator of successful exploitation or exploit testing.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
Page 71 of 191