Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of VBScript files using wscript.exe with the /B (batch) flag when the file is located within user-specific directories such as AppData, Temp, or user profiles. This pattern is commonly used by malware and loaders to execute scripts stealthily in user-writable locations.
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.
This rule detects scenarios where the Microsoft HTML Help executable (hh.exe) is used to open a .chm (Compiled HTML) file, which then triggers the execution of wscript.exe. This behavior is a common technique used by attackers to execute malicious scripts hidden within CHM files, bypassing security controls by leveraging a legitimate system binary to initiate script execution.
Detects instances where processes associated with Claude AI (e.g., node, shell) spawn suspicious child processes such as Python interpreters, pip package managers, or shell scripts (sh, bash) with command-line arguments indicative of AI-driven project initiation, package installation, or automated setup tasks. This pattern is characteristic of AI-based agents executing code or performing automation on a developer workstation.
Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects the resolution of DNS TXT records using dig, followed by piping the decoded base64 output directly to bash for execution. This technique is characteristic of fileless payload delivery and remote command execution, specifically observed in the Axiom indirect prompt injection attack chain.
This rule detects the execution of script files (.vbs, .ps1, .hta, .lnk, .exe) from potential removable media drives (drive letters D-Z) by common Windows interpreters (wscript.exe, cscript.exe, powershell.exe). It monitors for these processes being launched either as standalone processes or as children of other scripts, explorer.exe, or interpreters, while explicitly excluding paths typically associated with legitimate Windows system and program directories.
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
This rule detects the use of 'wmic.exe' with the '/format' switch to execute XSL files, or the direct execution of 'msxsl.exe'. These methods are common techniques used by adversaries to bypass security controls by executing arbitrary scripts embedded within XSL files, often fetched from remote locations or local paths.
This rule detects the use of common Windows utilities and PowerShell commands for process discovery, such as tasklist.exe, wmic.exe, and Get-Process. It also flags execution of command lines containing references to known antivirus, EDR, or security agent process names, which is a common indicator of an adversary attempting to identify or disable security tools.
Detects the execution of known script host binaries (mshta.exe, wscript.exe, cscript.exe) from suspicious user-writable directories (Downloads, Temp, AppData, Desktop). The detection specifically looks for these binaries when spawned by common applications like archive utilities (7-zip, WinRAR, WinZip) or shell interfaces (explorer.exe, cmd.exe, powershell.exe), which is a common pattern for the execution of downloaded or extracted malicious payloads.
This rule detects scenarios where a common web browser (Chrome, Firefox, Edge, IE, Opera, or Brave) connects to an external destination not on a known allow-list, followed shortly (within 30 seconds) by the execution of a script-based binary (wscript.exe or mshta.exe) on the same host. This is a common pattern for initial access where a user downloads a malicious script from an unknown source via a browser and subsequently executes it.
This rule detects scenarios where a common web browser (Chrome, Firefox, Edge, IE, Opera, or Brave) connects to an external destination not on a known allow-list, followed shortly (within 30 seconds) by the execution of a script-based binary (wscript.exe or mshta.exe) on the same host. This is a common pattern for initial access where a user downloads a malicious script from an unknown source via a browser and subsequently executes it.
Detects the execution of a malicious npm package disguised as '@withgoogle/stitch-sdk'. The package uses a 'preinstall.js' script to harvest sensitive developer credentials, including API keys, Git credentials, SSH keys, and Docker tokens, and attempts to exfiltrate this data to an attacker-controlled domain (stitch-production.org).
Detects node.exe executing 'test.js' as a child process of NPM lifecycle scripts (postinstall/preinstall). This behavior is characteristic of malicious NPM packages like 'ts-bn-lint' and 'log-taker' used in the Polymarket Trap campaign to execute an embedded infostealer payload.
Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.
Detects various privilege escalation and reconnaissance techniques commonly associated with the 'Operation Poisson' campaign, including UAC bypass attempts, local administrator group enumeration, and administrative privilege verification triggered by script interpreters.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects the execution of Python interpreters or scripts involving keylogging-related libraries (pynput, pyxhook, pywin32, keyboard) or direct access to Linux input devices (/dev/input/event*), correlated with the creation of temporary script files, which is a common pattern for Python-based keyloggers.
Page 76 of 191