Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects LCRYX ransomware activity orchestrated by VBScript using wscript.exe or cscript.exe. The rule monitors for the mass encryption of files identified by the .lcryx extension and the creation of PLEASEREADME.txt ransom notes, typical behaviors of this ransomware variant.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects the execution of wscript.exe or cscript.exe with the /elevated command-line argument, which is a known technique for bypassing User Account Control (UAC) or invoking administrative tasks via COM object elevation.
This rule detects potential exploitation of SAP Remote Function Call (RFC) mechanisms, specifically targeting abuse of SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT which allow execution of OS commands via SAP. It identifies the execution of known malicious SAP-related scripts, suspicious OS commands (such as whoami, reading /etc/passwd or /etc/shadow) spawned by SAP work processes, and command line activity originating from privileged SAP service accounts.
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
Detects the creation of scheduled tasks designed for persistence, typically used by Operation Poisson (e.g., Demon agent, Python keyloggers). The rule identifies tasks that execute script interpreters (powershell.exe, cmd.exe, wscript.exe, cscript.exe, python.exe, pythonw.exe) with indicators of suspicious intent, such as hidden windows (/WindowStyle Hidden, /c) or elevated privileges (HighestAvailable, HighestPrivilege, AtLogon).
Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects the creation of a Windows scheduled task using 'schtasks.exe' with the 'Highest' run level, configured to execute either 'powershell.exe' or 'wscript.exe'. This pattern is consistent with persistence mechanisms observed in Operation Poisson, where attackers establish elevated, automated execution of scripts.
Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.
Detects the execution of Python processes with command-line arguments indicative of keylogging activity (e.g., pynput, keyboard, keylog) or Python processes creating/writing to files with names suggesting keylogging behavior (e.g., log.txt, keylog). This rule targets potential data collection via keyboard interception by monitoring process creation and file write events.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Detects the execution of SyncAppvPublishingServer.vbs via wscript.exe or cscript.exe. This legitimate Windows script can be abused by adversaries to proxy execution of malicious PowerShell commands, bypassing execution restrictions and evading defensive measures.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Detects attempts to establish persistence by modifying registry run keys (Run or RunOnce) to execute scripting interpreters like PowerShell, cmd, or wscript. The rule looks for at least two such events within an hour on the same device and registry key, indicating potential malicious activity.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects the use of regsvr32.exe with the /s (silent) and /u (unregister) flags to execute a remote scriptlet file (e.g., .sct, scrobj.dll) via HTTP, a common technique for proxy execution and bypassing application control mechanisms.
Page 84 of 191