Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects execution chains where Outlook launches a VBScript file that subsequently invokes PowerShell with encoded commands, characteristic of Gamaredon (ACTINIUM) threat activity. Additionally, it identifies the creation of VBScript/VBE files in temporary directories, which is consistent with the deployment of PteroVDoor or PteroPSDoor loaders.
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects instances where mshta.exe is used to launch suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe, or is associated with HTA files or PteroSand-related indicators. This behavior is indicative of HTML smuggling or malicious HTA-based delivery of secondary payloads.
This rule detects potentially malicious shell execution (e.g., bash -i, /dev/tcp/ reverse shells, netcat) spawned directly or indirectly by common media processing applications such as ffmpeg, ffprobe, jellyfin, or nextcloud. It identifies when these applications initiate shell processes or execute command lines that exhibit suspicious behavior or access specific media-related paths commonly targeted for abuse.
Detects the execution of PowerShell or Bash commands, potentially for implant delivery, spawned from Visual Studio Code extension host processes (node.exe, code.exe, code-server, cursor). This rule specifically looks for command-line patterns associated with the GLASSWORM.WASM threat, such as 'irm', 'iex', 'curl -fsSL', 'Invoke-Expression', 'IEX', or combinations of 'powershell -Command', 'curl -fsSL', and 'bash -c'.
Detects instances where the Node.js executable (node.exe) spawns common command shells or scripting interpreters such as cmd.exe, powershell.exe, pwsh.exe, or wscript.exe. This behavior is often indicative of Node.js-based applications being used as a staging point for command execution, a common pattern in post-exploitation or the usage of malicious npm packages.
Detects instances where the Node.js executable (node.exe) spawns common command shells or scripting interpreters such as cmd.exe, powershell.exe, pwsh.exe, or wscript.exe. This behavior is often indicative of Node.js-based applications being used as a staging point for command execution, a common pattern in post-exploitation or the usage of malicious npm packages.
Detects multiple host enumeration techniques indicative of pre-encryption discovery activity. The rule monitors for the sequential or combined use of tasklist.exe, PowerShell Get-Process, cmd dir /s, and findstr.exe on a single host within a 30-minute window, which is a common behavior pattern for various ransomware strains.
Detects instances where the LINE messaging application (LINE.exe) initiates child processes commonly associated with malware delivery, such as command-line shells, script interpreters, and archive utilities. This pattern is often indicative of TA4922 activity, which leverages themed lures (HR, payroll, tax) delivered via the platform to execute malicious payloads.
Detects the execution of Python interpreters from suspicious or user-writable locations such as Temp, Downloads, or AppData directories. The rule explicitly excludes known legitimate development and coding environments, focusing on potential malicious script execution, often associated with droppers or secondary payloads that are not managed by typical IDEs or development tools.
Detects Python-based execution of system binaries (wmic.exe, reg.exe, tasklist.exe, systeminfo.exe) used for environment reconnaissance, specifically targeting VM and sandbox detection artifacts characteristic of the SilentRunLoader malware.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
This rule detects potentially unauthorized or suspicious outbound network connections to common Generative AI service APIs (OpenAI, Anthropic, Mistral) originating from command-line interpreters (cmd.exe, powershell.exe) or python.exe instances running from temporary directories, which could indicate data exfiltration or the use of AI tools for malicious automation.
Page 83 of 191