Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
This rule detects potentially suspicious process activity where unknown or infrequently seen processes spawn common script interpreters such as cmd.exe, powershell.exe, wscript.exe, or others. This behavior often indicates an attempt to execute malicious commands or scripts as part of a post-exploitation or persistence mechanism.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Detects instances where wscript.exe or cscript.exe executing a VBScript file subsequently spawns taskkill.exe with arguments intended to terminate PowerShell processes. This is a common pattern used by malicious scripts to disrupt security monitoring or automated management tasks.
Detects the execution or network communication involving python-build-standalone, a tool often used by developers to deploy portable Python environments. In an environment, the unauthorized use of this tool may indicate an adversary attempting to deploy their own Python interpreter to execute malicious scripts, effectively bypassing environment-specific restrictions or configurations.
This rule detects the execution of 'hdiutil' to attach a disk image with the '-nobrowse' flag, initiated by various scripting interpreters (bash, zsh, python, etc.) or terminal applications. This pattern is frequently used by adversaries to silently mount malicious payloads or tools contained within disk images while bypassing user interaction.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
This rule detects the execution of common scripting interpreters (powershell.exe, wscript.exe, cscript.exe, mshta.exe) where the command line arguments contain domains associated with the Dropbox API. This behavior is indicative of potential data exfiltration or the downloading of malicious payloads via a legitimate cloud storage service, a common technique for bypassing network filters and security controls.
Detects execution of script interpreters (wscript.exe, cscript.exe) or HTML Application host (mshta.exe) when spawned by Microsoft Office applications (Winword, Excel, PowerPoint, Outlook) or mshta.exe. This pattern is characteristic of the Gamaredon group's spear-phishing delivery chains (e.g., PteroOdd, PteroDum) that utilize macro-enabled documents or malicious HTA files to execute malicious VBScript.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
This rule detects network connections initiated by common Windows script interpreters (PowerShell, WScript, CScript, MSHTA) to known public paste or text sharing services. Adversaries often use these sites to host malicious payloads, C2 configurations, or to exfiltrate data, bypassing traditional network blocks by using reputable services. The rule excludes processes signed by Microsoft to reduce noise.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects a two-stage attack chain where a host downloads an image file from the network, followed by the execution of suspicious system binaries (e.g., mshta, powershell, rundll32). This pattern is characteristic of steganographic loaders like CloudEyE or DBatLoader used to extract and execute payloads like Remcos RAT.
This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects the execution of Node.js processes ('node' or 'node.exe') with command-line arguments that match known patterns often associated with software installation scripts, post-installation tasks, or peer verification activities. While these file names can be legitimate, they are also commonly leveraged by attackers for malicious script execution or persistence.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
Detects the use of PowerShell, PWSH, or CMD to modify file system timestamps, a technique commonly referred to as timestomping. This is often used by adversaries to hide malicious file activity or blend in with legitimate system files by manipulating file creation, modification, or access time metadata.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
Page 78 of 191